Untitled

<group desc="Access to the Windows Registry" id=1>
      <name>"Registry"</name>
</group>

<group desc="Access to the file system" id=2>
      <name>"File system"</name>
</group>

<rule desc="is a run/runonce registry key opened?" id=1>
     <name>"RegOpenKey"</name>
     <argument>
        <index>2</Index>
        <action>EqualSubString</action>
        <data>"Run"</data>
     </argument>
</rule>

<rule desc="print 1st CreateFile argument" id=2>
     <name>"CreateFile"</name>
     <argument>
        <index>1</index>
        <action>PrintString</action>
     </argument>
</rule>


<ruleset desc="Registry run/runonce" id=1>
     <group>1</Group>
     <op type="OR">
         <rule ref="1"</rule>
         <rule ref="n"</rule>
     </op>
     <info>"Registry startup method (run/runonce)"</info>
</ruleset>

<ruleset desc="CreateFile file access" id=2>
     <group>2</group>
     <rule>2</rule>
     <info>"Accesses the following file:"</info>
</ruleset>