[
    {
        "rulename": "Abuse.ch feodo",
        "if": {
            "feed.url": ".*feodotracker.*download=.*$",
            "classification.identifier": "",
            "feed.name": "^Abuse.ch$"
        },
        "then": {
            "classification.identifier": "feodo"
        }
    },
    {
        "rulename": "Dragon Research Group vncprobe",
        "if": {
            "feed.url": "vncprobe.txt$",
            "classification.identifier": "",
            "feed.name": "^Dragon Research Group$"
        },
        "then": {
            "classification.identifier": "vncprobe"
        }
    },
    {
        "rulename": "Spamhaus Cert",
        "if": {
            "classification.identifier": "",
            "feed.name": "^Spamhaus Cert$"
        },
        "then": {
            "classification.identifier": "{msg[malware.name]}"
        }
    },
    {
        "rulename": "Dragon Research Group default",
        "if": {
            "classification.identifier": "",
            "feed.name": "^Dragon Research Group$"
        },
        "then": {
            "classification.identifier": "{msg[malware.name]}"
        }
    },
    {
        "rulename": "Standard Protocols http",
        "if": {
            "source.port": "^(80|443)$"
        },
        "then": {
            "protocol.application": "http",
            "protocol.transport": "tcp"
        }
    },
    {
        "rulename": "Fraunhofer DGA",
        "if": {
            "classification.identifier": "",
            "feed.name": "^Fraunhofer DGA$"
        },
        "then": {
            "classification.identifier": "dga"
        }
    },
    {
        "rulename": "Blocklist.de imap",
        "if": {
            "feed.url": "imap.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "imap"
        }
    },
    {
        "rulename": "Blocklist.de bots",
        "if": {
            "feed.url": "bots.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "spam"
        }
    },
    {
        "rulename": "Blocklist.de bruteforcelogin",
        "if": {
            "feed.url": "bruteforcelogin.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "http"
        }
    },
    {
        "rulename": "Blocklist.de strongip",
        "if": {
            "feed.url": "strongips.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "blacklist"
        }
    },
    {
        "rulename": "Blocklist.de ssh",
        "if": {
            "feed.url": "ssh.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "ssh"
        }
    },
    {
        "rulename": "Blocklist.de smtp",
        "if": {
            "feed.url": "mail.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "smtp"
        }
    },
    {
        "rulename": "Blocklist.de http",
        "if": {
            "feed.url": "apache.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "http"
        }
    },
    {
        "rulename": "Blocklist.de irc",
        "if": {
            "feed.url": "irc.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "irc"
        }
    },
    {
        "rulename": "Blocklist.de ftp",
        "if": {
            "feed.url": "ftp.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "ftp"
        }
    },
    {
        "rulename": "Blocklist.de sip",
        "if": {
            "feed.url": "sip.txt$",
            "classification.identifier": "",
            "feed.name": "^BlockList\\.de$"
        },
        "then": {
            "classification.identifier": "sip"
        }
    },
    {
        "rulename": "securityscorecard",
        "if": {
            "malware.name": "securityscorecard-(.*)$"
        },
        "then": {
            "classification.identifier": "{matches[malware.name][1]}"
        }
    },
    {
        "rulename": "bitdefender",
        "if": {
            "classification.identifier": "",
            "malware.name": "^bitdefender-(.*)$"
        },
        "then": {
            "classification.identifier": "{matches[malware.name][1]}"
        }
    },
    {
        "rulename": "malware name indicates c2",
        "if": {
            "malware.name": "-c2",
            "classification.type": "infected-system"
        },
        "then": {
            "classification.type": "c2-server"
        }
    },
    {
        "rulename": "default",
        "if": {
            "malware.name": ".*",
            "classification.taxonomy": "malicious-code",
            "classification.identifier": ""
        },
        "then": {
            "classification.identifier": "{msg[malware.name]}"
        }
    }
]
