<group name="windows,">
<rule id="100050" level="10">
  <decoded_as>json</decoded_as>
  <field name="Entry">\.+</field>
  <field name="EntryLocation">\.+</field>
  <description>Windows Autoruns - VirusTotal Hit</description>
  <mitre>
   <id>T1547</id>
  </mitre>
  <options>no_full_log</options>
  <group>windows_autoruns,</group>
</rule>
<rule id="100051" level="10">
  <if_sid>100050</if_sid>
  <field name="VTdetection">Unknown</field>
  <description>Windows Autoruns - VirusTotal Unknown Signature</description>
  <mitre>
   <id>T1547</id>
  </mitre>
  <options>no_full_log</options>
  <group>windows_autoruns,</group>
</rule>
<rule id="100052" level="12">
  <if_sid>100050</if_sid>
  <field name="VTdetection">^\d\d\|</field>
  <description>Windows Autoruns - VirusTotal Hit Above 10 Matches</description>
  <mitre>
   <id>T1547</id>
  </mitre>
  <options>no_full_log</options>
  <group>windows_autoruns,</group>
</rule>
</group>
