rule:
  meta:
    name: <descriptive rule name>
    namespace: <category/subcategory>
    authors:
      - <author name or handle>
    scope: function  # function | file | basic block
    description: >-
      <Detailed description of what this rule detects and why it matters.
       Include context about the technique or malware family.>
    att&ck:
      - <Tactic>::<Technique Name> [<Technique ID>]
      # Example: Defense Evasion::Process Injection [T1055]
    mbc:
      - <Objective>::<Behavior> [<Behavior ID>]
      # Example: Anti-Behavioral Analysis::Debugger Detection [B0001]
    references:
      - <URL to technique documentation or analysis report>
    examples:
      - <SHA256 hash of a sample that matches this rule>
  features:
    # Simple single-feature match:
    # - api: CreateRemoteThread

    # Multiple features that must all be present:
    - and:
        - api: <Windows API or function name>
        - api: <second required API>
        # String matching (literal):
        # - string: "literal string"
        # String matching (case-insensitive):
        # - string: "text" = description
        # Regex string matching:
        # - string: /regex_pattern/i
        # Byte pattern matching:
        # - bytes: 4D 5A 90 00 = MZ header
        # Numeric constant:
        # - number: 0x5A4D
        #   description: MZ magic
        # File offset:
        # - offset: 0x3C = PE header offset
        # Assembly mnemonic:
        # - mnemonic: rdtsc
        # OS restriction:
        # - os: windows
        # Architecture restriction:
        # - arch: i386
        # Match another rule:
        # - match: <other rule name>
        # .NET property access:
        # - property/read: System.Environment.UserName

    # Alternative matches (any one sufficient):
    # - or:
    #     - api: CreateFileA
    #     - api: CreateFileW

    # Negation (must NOT be present):
    # - not:
    #     - api: <API that should be absent>

    # Count-based (at least N matches required):
    # - count(api(Sleep)): 5 or more
    # - count(string("http")): 2 or more

    # Optional features (enhance match but not required):
    # - optional:
    #     - api: <nice-to-have API>
    #     - string: "optional indicator"