• File size measurements show the distribution of size of files.
• Files are classified in four categories based on their size (lines of code): 1-100 (very small files), 101-200 (small files), 201-500 (medium size files), 501-1000 (long files), 1001+(very long files).
• It is a good practice to keep files small. Long files may become "bloaters", code that have increased to such gargantuan proportions that they are hard to work with.

• There are 1,674 files with 113,130 lines of code.
• 7 very long files (14,239 lines of code)
• 4 long files (2,911 lines of code)
• 24 medium size files (6,884 lines of codeclsfd_ftr_w_mp_ins)
• 117 small files (15,486 lines of code)
• 1,522 very small files (73,610 lines of code)

There are 826 files with lines longer than 120 characters. In total, there are 3117 long lines.

File	# lines	# units	# long lines
yar Windows_Generic_Threat.yar in yara/rules	3502	-	152
lua artifact.lua in ransomware	3044	66	89
command_and_control_execution_from_suspicious_stack_trailing_bytes.toml in behavior/rules/windows	122	-	64
defense_evasion_network_module_loaded_from_suspicious_unbacked_memory.toml in behavior/rules/windows	249	-	55
defense_evasion_ntdll_memory_protection_change_via_unsigned_dll.toml in behavior/rules/windows	80	-	38
yar Linux_Generic_Threat.yar in yara/rules	1174	-	35
defense_evasion_potential_shellcode_injection_via_clr.toml in behavior/rules/windows	125	-	30
impact_potential_crypto_mining_activity.toml in behavior/rules/windows	84	-	27
defense_evasion_direct_syscall_via_assembly_bytes.toml in behavior/rules/windows	100	-	23
credential_access_failed_access_attempt_to_web_browser_files.toml in behavior/rules/windows	157	-	23
defense_evasion_suspicious_windows_core_module_change.toml in behavior/rules/windows	90	-	23
defense_evasion_suspicious_remote_memory_allocation.toml in behavior/rules/windows	103	-	22
defense_evasion_suspicious_parent_child_relationship.toml in behavior/rules/windows	116	-	21
defense_evasion_potential_shellcode_fluctuation_v1.toml in behavior/rules/windows	121	-	20
yar Windows_Trojan_Trickbot.yar in yara/rules	937	-	20
yar Linux_Trojan_Mettle.yar in yara/rules	79	-	20
defense_evasion_binary_masquerading_via_untrusted_path.toml in behavior/rules/windows	214	-	19
credential_access_access_to_browser_credentials_from_suspicious_memory.toml in behavior/rules/windows	134	-	19
yar Multi_Trojan_Sliver.yar in yara/rules	86	-	19
command_and_control_potential_known_tcp_port_traffic_tunneling.toml in behavior/rules/windows	78	-	18
persistence_scheduled_task_creation_by_an_unusual_process.toml in behavior/rules/windows	160	-	18
execution_initial_access_via_macos_installer_package.toml in behavior/rules/macos	202	-	18
defense_evasion_potential_library_load_via_rop_gadgets.toml in behavior/rules/windows	57	-	17
privilege_escalation_potential_execution_via_token_theft.toml in behavior/rules/windows	110	-	17
defense_evasion_internet_activity_from_suspicious_unbacked_memory.toml in behavior/rules/windows	93	-	16
defense_evasion_rundll32_or_regsvr32_loaded_a_dll_from_unbacked_memory.toml in behavior/rules/windows	100	-	16
defense_evasion_image_hollow_from_unusual_stack.toml in behavior/rules/windows	78	-	15
discovery_suspicious_security_product_enumeration.toml in behavior/rules/windows	136	-	15
yar Windows_Trojan_Emotet.yar in yara/rules	160	-	15
defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml in behavior/rules/windows	66	-	14
lateral_movement_suspicious_process_execution_via_network_logon.toml in behavior/rules/windows	356	-	14
yar Windows_Trojan_Nighthawk.yar in yara/rules	72	-	14
defense_evasion_shellcode_execution_via_a_callback_function.toml in behavior/rules/windows	71	-	13
persistence_suspicious_windows_schedule_child_process.toml in behavior/rules/windows	167	-	13
execution_process_creation_from_an_unusual_wmi_client.toml in behavior/rules/windows	71	-	13
execution_suspicious_execution_via_windows_management_instrumentation.toml in behavior/rules/windows	123	-	13
defense_evasion_potential_ntdll_memory_unhooking.toml in behavior/rules/windows	85	-	13
yar Windows_Ransomware_Sodinokibi.yar in yara/rules	89	-	13
defense_evasion_unbacked_shellcode_from_unsigned_module.toml in behavior/rules/windows	138	-	12
discovery_suspicious_windows_ldap_image_load.toml in behavior/rules/windows	67	-	12
execution_suspicious_windows_command_shell_execution.toml in behavior/rules/windows	144	-	12
defense_evasion_process_creation_with_unusual_mitigation.toml in behavior/rules/windows	88	-	12
defense_evasion_suspicious_windows_explorer_execution.toml in behavior/rules/windows	83	-	12
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml in behavior/rules/windows	231	-	12
execution_suspicious_powershell_execution_via_windows_scripts.toml in behavior/rules/windows	128	-	12
credential_access_credential_access_via_known_utilities.toml in behavior/rules/windows	94	-	12
yar Windows_Trojan_CobaltStrike.yar in yara/rules	1041	-	12
yar Linux_Trojan_Metasploit.yar in yara/rules	425	-	12
defense_evasion_parent_process_pid_spoofing.toml in behavior/rules/windows	148	-	11
execution_suspicious_windows_script_interpreter_child_process.toml in behavior/rules/windows	91	-	11