def rule(event):
    if any(
        [
            event.deep_get("Signature", default="").startswith("PWS"),
            any(
                [
                    "Certify" in event.deep_get("Signature", default=""),
                    "DCSync" in event.deep_get("Signature", default=""),
                    "DumpCreds" in event.deep_get("Signature", default=""),
                    "DumpLsass" in event.deep_get("Signature", default=""),
                    "DumpPert" in event.deep_get("Signature", default=""),
                    "HTool/WCE" in event.deep_get("Signature", default=""),
                    "Kekeo" in event.deep_get("Signature", default=""),
                    "Lazagne" in event.deep_get("Signature", default=""),
                    "LsassDump" in event.deep_get("Signature", default=""),
                    "Mimikatz" in event.deep_get("Signature", default=""),
                    "MultiDump" in event.deep_get("Signature", default=""),
                    "Nanodump" in event.deep_get("Signature", default=""),
                    "NativeDump" in event.deep_get("Signature", default=""),
                    "Outflank" in event.deep_get("Signature", default=""),
                    "PShlSpy" in event.deep_get("Signature", default=""),
                    "PSWTool" in event.deep_get("Signature", default=""),
                    "PWCrack" in event.deep_get("Signature", default=""),
                    "PWDump" in event.deep_get("Signature", default=""),
                    "PWS." in event.deep_get("Signature", default=""),
                    "PWSX" in event.deep_get("Signature", default=""),
                    "pypykatz" in event.deep_get("Signature", default=""),
                    "Rubeus" in event.deep_get("Signature", default=""),
                    "SafetyKatz" in event.deep_get("Signature", default=""),
                    "SecurityTool" in event.deep_get("Signature", default=""),
                    "SharpChrome" in event.deep_get("Signature", default=""),
                    "SharpDPAPI" in event.deep_get("Signature", default=""),
                    "SharpDump" in event.deep_get("Signature", default=""),
                    "SharpKatz" in event.deep_get("Signature", default=""),
                    "SharpS." in event.deep_get("Signature", default=""),
                    "ShpKatz" in event.deep_get("Signature", default=""),
                    "TrickDump" in event.deep_get("Signature", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
