def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 4662,
            "bf967aba-0de6-11d0-a285-00aa003049e2" in event.deep_get("ObjectType", default=""),
            any(
                [
                    event.deep_get("AccessMask", default="").endswith("1?"),
                    event.deep_get("AccessMask", default="").endswith("3?"),
                    event.deep_get("AccessMask", default="").endswith("4?"),
                    event.deep_get("AccessMask", default="").endswith("7?"),
                    event.deep_get("AccessMask", default="").endswith("9?"),
                    event.deep_get("AccessMask", default="").endswith("B?"),
                    event.deep_get("AccessMask", default="").endswith("D?"),
                    event.deep_get("AccessMask", default="").endswith("F?"),
                ]
            ),
            not any(
                [
                    event.deep_get("SubjectUserName", default="").endswith("$"),
                    event.deep_get("SubjectUserName", default="").startswith("MSOL_"),
                ]
            ),
        ]
    ):
        return True
    return False
