Stuff

<group id=1>
  <name>Registry</name>
  <desc>Access to the Windows Registry</desc>
</group>

<group id=2>
  <name>File system</name>
  <desc>Access to the file system</desc>
</group>

<rule id=1>
  <function>RegOpenKey</function>
  <desc>Is a run/runonce registry key opened?</desc>
  <argument>
    <index>2</Index>
    <action>EqualSubString</action>
    <data>Run</data>
  </argument>
</rule>

<rule id=2>
  <function>CreateFile</function>
  <desc>Print 1st CreateFile argument</desc>
  <argument>
    <index>1</index>
    <action>PrintString</action>
  </argument>
</rule>


<ruleset id=1>
  <name>Registry run/runonce</name>
  <group ref="1"/>
  <op type="OR">
    <rule ref="1"/>
    <rule ref="n"/>
  </op>
  <info>Registry startup method (run/runonce)</info>
</ruleset>

<ruleset id=2>
  <name>CreateFile file access</name>
  <group ref="2"/>
  <rule ref="2"/>
  <info>Accesses the following file:</info>
</ruleset>