def rule(event):
    if any(
        [
            any(
                [
                    event.deep_get("TargetFilename", default="").endswith("\\Andrew.dmp"),
                    event.deep_get("TargetFilename", default="").endswith("\\Coredump.dmp"),
                    event.deep_get("TargetFilename", default="").endswith("\\lsass.dmp"),
                    event.deep_get("TargetFilename", default="").endswith("\\lsass.rar"),
                    event.deep_get("TargetFilename", default="").endswith("\\lsass.zip"),
                    event.deep_get("TargetFilename", default="").endswith("\\NotLSASS.zip"),
                    event.deep_get("TargetFilename", default="").endswith("\\PPLBlade.dmp"),
                    event.deep_get("TargetFilename", default="").endswith("\\rustive.dmp"),
                ]
            ),
            any(
                [
                    "\\lsass_2" in event.deep_get("TargetFilename", default=""),
                    "\\lsassdmp" in event.deep_get("TargetFilename", default=""),
                    "\\lsassdump" in event.deep_get("TargetFilename", default=""),
                ]
            ),
            all(
                [
                    "\\lsass" in event.deep_get("TargetFilename", default=""),
                    ".dmp" in event.deep_get("TargetFilename", default=""),
                ]
            ),
            all(
                [
                    "SQLDmpr" in event.deep_get("TargetFilename", default=""),
                    event.deep_get("TargetFilename", default="").endswith(".mdmp"),
                ]
            ),
            all(
                [
                    any(
                        [
                            "\\nanodump" in event.deep_get("TargetFilename", default=""),
                            "\\proc_" in event.deep_get("TargetFilename", default=""),
                        ]
                    ),
                    event.deep_get("TargetFilename", default="").endswith(".dmp"),
                ]
            ),
        ]
    ):
        return True
    return False
