def rule(event):
    if all(
        [
            ":\\Windows\\SysWOW64\\" in event.deep_get("SourceImage", default=""),
            event.deep_get("GrantedAccess", default="") == "0x1fffff",
            event.deep_get("CallTrace", default="").startswith(
                "UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|"
            ),
        ]
    ):
        return True
    return False
