Untitled

<rule name="RegOpenKey" id=1>
     <argument>
        <index>2</Index>
        <action>EqualSubString</action>
        <data>"Run"</data>
     </argument>
</rule>

<rule name="CreateFile" id=2>
     <argument>
        <index>1</index>
        <action>PrintString</action>
     </argument>
</rule>


<ruleset name="Registry run/runonce" id=1>
     <group>Registry</Group>
     <op type="OR">
         <rule ref="1"/rule>
         <rule ref="n"/rule>
     </op>
     <description>"Registry startup method (run/runonce)"</description>
</ruleset>

<ruleset name="CreateFile file access" id=2>
     <group>File access</group>
     <rule>2</rule>
     <description>"Accesses the following file:"</description>
</ruleset>