rule = [
    {'name': "BRC4", 'rules': ['T1071', 'T1071.001',
                               'T1622', 'T1047', 'T1562.001'], 'hit_num': 4, 'score':100},
    {'name': "BRC4#2", 'rules': ['T1071.004',
                                 'T1071.001', 'T1562.001', 'CMT0001', 'CMT0002', 'CMT0003'], 'hit_num': 6, 'score':100},
    {'name': "Ransomware", 'rules': ['T1071',
                                     'T1036.005', 'T1620', 'T1564.001', 'T1222.001', 'T1059.005', 'T1543.003', 'T1490'], 'hit_num': 7, 'score':100},
    {'name': "APT-System discovery", 'rules': ['T1018',
                                               'T1087.001', 'T1087.001', 'T1082', 'T1016'], 'hit_num': 3, 'score':65},
    {'name': "APT-Hydra", 'rules': ['T1027.004',
                                    'T1018', 'T1559.001', 'T1218.011', 'T1059.001', 'T1059.005', 'T1570', 'T1087.002', 'T1564', 'T1106', 'T1082', 'T1087.001', 'T1003', 'T1071'], 'hit_num': 10, 'score':100}
]