A Tiny Behavior-Scoring Rule

# Score a Procmon CSV export of a single detonation
RULES = [
    ("Run key persistence", 30,
        lambda e: "\\CurrentVersion\\Run" in e["Path"]
                  and e["Operation"] == "RegSetValue"),
    ("Shadow copy deletion", 50,
        lambda e: "vssadmin" in e["Detail"].lower()
                  and "delete" in e["Detail"].lower()),
    ("Defender tampering", 40,
        lambda e: "DisableRealtimeMonitoring" in e["Detail"]),
]

def score(events):
    total, hits = 0, []
    for name, weight, test in RULES:
        if any(test(e) for e in events):
            total += weight
            hits.append((name, weight))
    verdict = "MALICIOUS" if total >= 50 else "SUSPICIOUS"
    return total, verdict, hits