[
    {
        "rulename": "Standard Protocols all-tcp",
        "if": {
            "protocol.transport": ""
        },
        "then": {
            "protocol.transport": "tcp"
        }
    },
    {
        "rulename": "Standard Protocols http",
        "if": {
            "source.port": "^(80|443)$"
        },
        "then": {
            "protocol.application": "http"
        }
    },
    {
        "rulename": "xcodeghost",
        "if": {
            "malware.name": "^xcodeghost$"
        },
        "then": {
            "classification.identifier": "xcodeghost"
        }
    },
    {
        "rulename": "citadel",
        "if": {
            "malware.name": "^[Cc]itadel( certpl| MS|ch|-54|-b54)?$"
        },
        "then": {
            "classification.identifier": "citadel"
        }
    },
    {
        "rulename": "pushdo",
        "if": {
            "malware.name": "^(all4family_|manual)?[Pp]ushdo$"
        },
        "then": {
            "classification.identifier": "pushdo"
        }
    },
    {
        "rulename": "securityscorecard",
        "if": {
            "malware.name": "securityscorecard-(.*)$"
        },
        "then": {
            "classification.identifier": "{matches[malware.name][1]}"
        }
    },
    {
        "rulename": "zeus",
        "if": {
            "malware.name": "^((p2p)?[Zz]eus(_p2p|_[Gg]ameover(_(us|US))?|VM)?|botnet_certtw)$"
        },
        "then": {
            "classification.identifier": "zeus"
        }
    },
    {
        "rulename": "sality_virus",
        "if": {
            "malware.name": "^[Ss]ality_[Vv]irus$"
        },
        "then": {
            "classification.identifier": "sality"
        }
    },
    {
        "rulename": "caphaw",
        "if": {
            "malware.name": "^caphaw$"
        },
        "then": {
            "classification.identifier": "caphaw/shylock"
        }
    },
    {
        "rulename": "urlzone",
        "if": {
            "malware.name": "^urlzone2?$"
        },
        "then": {
            "classification.identifier": "urlzone/bebloh"
        }
    },
    {
        "rulename": "tinba",
        "if": {
            "malware.name": "^tinba-dga$"
        },
        "then": {
            "classification.identifier": "tinba"
        }
    },
    {
        "rulename": "sality",
        "if": {
            "malware.name": "^[Ss]ality([_-]p2p)?(v)?[0-9]?$"
        },
        "then": {
            "classification.identifier": "sality"
        }
    },
    {
        "rulename": "bitdefender",
        "if": {
            "classification.identifier": "",
            "malware.name": "^bitdefender-(.*)$"
        },
        "then": {
            "classification.identifier": "{matches[malware.name][1]}"
        }
    },
    {
        "rulename": "downadup",
        "if": {
            "malware.name": "^downadup$"
        },
        "then": {
            "classification.identifier": "conficker"
        }
    },
    {
        "rulename": "gameoverzeusdga",
        "if": {
            "malware.name": "^gameover-zeus-dga$"
        },
        "then": {
            "classification.identifier": "gameover zeus dga"
        }
    },
    {
        "rulename": "gozi",
        "if": {
            "malware.name": "^gozi2?$"
        },
        "then": {
            "classification.identifier": "gozi"
        }
    },
    {
        "rulename": "brobot",
        "if": {
            "malware.name": "^[Bb]robot(bsi|fbi|us)?$"
        },
        "then": {
            "classification.identifier": "brobot"
        }
    },
    {
        "rulename": "gameoverzeuspeer",
        "if": {
            "malware.name": "^gameover-zeus-peer$"
        },
        "then": {
            "classification.identifier": "gameover zeus p2p"
        }
    },
    {
        "rulename": "bitdefender-sumxa",
        "if": {
            "malware.name": "^bitdefender-sumxa$"
        },
        "then": {
            "classification.identifier": "dridex"
        }
    },
    {
        "rulename": "b68zeroaccess",
        "if": {
            "malware.name": "^b68-zeroaccess-.-..bit$"
        },
        "then": {
            "classification.identifier": "zeroaccess"
        }
    },
    {
        "rulename": "bitdefender-foreign",
        "if": {
            "malware.name": "^bitdefender-foreign$"
        },
        "then": {
            "classification.identifier": "trojan.generic"
        }
    },
    {
        "rulename": "bitdefender-pykspa_improved",
        "if": {
            "malware.name": "^bitdefender-pykspa_improved$"
        },
        "then": {
            "classification.identifier": "pykspa"
        }
    },
    {
        "rulename": "conficker",
        "if": {
            "malware.name": "^conficker(ab)?$"
        },
        "then": {
            "classification.identifier": "conficker"
        }
    },
    {
        "rulename": "downloaderbot",
        "if": {
            "malware.name": "^downloaderbot-(mxb|2)$"
        },
        "then": {
            "classification.identifier": "downloader-bot"
        }
    },
    {
        "rulename": "dridex",
        "if": {
            "malware.name": "^dridex-data$"
        },
        "then": {
            "classification.identifier": "dridex"
        }
    },
    {
        "rulename": "default",
        "if": {
            "malware.name": ".*",
            "classification.identifier": ""
        },
        "then": {
            "classification.identifier": "{msg[malware.name]}"
        }
    }
]
