def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("endpoint", default="") == "JobAdd",
                    event.deep_get("operation", default="") == "atsvc",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "ITaskSchedulerService",
                    event.deep_get("operation", default="") == "SchRpcEnableTask",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "ITaskSchedulerService",
                    event.deep_get("operation", default="") == "SchRpcRegisterTask",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "ITaskSchedulerService",
                    event.deep_get("operation", default="") == "SchRpcRun",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "IWbemServices",
                    event.deep_get("operation", default="") == "ExecMethod",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "IWbemServices",
                    event.deep_get("operation", default="") == "ExecMethodAsync",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "svcctl",
                    event.deep_get("operation", default="") == "CreateServiceA",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "svcctl",
                    event.deep_get("operation", default="") == "CreateServiceW",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "svcctl",
                    event.deep_get("operation", default="") == "StartServiceA",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "svcctl",
                    event.deep_get("operation", default="") == "StartServiceW",
                ]
            ),
        ]
    ):
        return True
    return False
