def rule(event):
    if any(
        [
            event.deep_get("name", default="").endswith(".pst"),
            event.deep_get("name", default="").endswith(".ost"),
            event.deep_get("name", default="").endswith(".msg"),
            event.deep_get("name", default="").endswith(".nst"),
            event.deep_get("name", default="").endswith(".oab"),
            event.deep_get("name", default="").endswith(".edb"),
            event.deep_get("name", default="").endswith(".nsf"),
            event.deep_get("name", default="").endswith(".bak"),
            event.deep_get("name", default="").endswith(".dmp"),
            event.deep_get("name", default="").endswith(".kirbi"),
            event.deep_get("name", default="").endswith(".rdp"),
        ]
    ):
        return True
    return False
