def rule(event):
    if any(
        [
            all(
                [
                    any(
                        [
                            "\\MOVEit Transfer\\wwwroot\\"
                            in event.deep_get("TargetFilename", default=""),
                            "\\MOVEitTransfer\\wwwroot\\"
                            in event.deep_get("TargetFilename", default=""),
                        ]
                    ),
                    any(
                        [
                            event.deep_get("TargetFilename", default="").endswith(".7z"),
                            event.deep_get("TargetFilename", default="").endswith(".bat"),
                            event.deep_get("TargetFilename", default="").endswith(".dll"),
                            event.deep_get("TargetFilename", default="").endswith(".exe"),
                            event.deep_get("TargetFilename", default="").endswith(".ps1"),
                            event.deep_get("TargetFilename", default="").endswith(".rar"),
                            event.deep_get("TargetFilename", default="").endswith(".vbe"),
                            event.deep_get("TargetFilename", default="").endswith(".vbs"),
                            event.deep_get("TargetFilename", default="").endswith(".zip"),
                        ]
                    ),
                ]
            ),
            any(
                [
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEit Transfer\\wwwroot\\_human2.aspx.lnk"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEit Transfer\\wwwroot\\_human2.aspx"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEit Transfer\\wwwroot\\human2.aspx.lnk"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEit Transfer\\wwwroot\\human2.aspx"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEitTransfer\\wwwroot\\_human2.aspx.lnk"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEitTransfer\\wwwroot\\_human2.aspx"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEitTransfer\\wwwroot\\human2.aspx.lnk"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\MOVEitTransfer\\wwwroot\\human2.aspx"
                    ),
                ]
            ),
            all(
                [
                    any(
                        [
                            event.deep_get("CreationUtcTime", default="").startswith("2023-03- "),
                            event.deep_get("CreationUtcTime", default="").startswith("2023-04- "),
                            event.deep_get("CreationUtcTime", default="").startswith("2023-05- "),
                            event.deep_get("CreationUtcTime", default="").startswith("2023-06- "),
                        ]
                    ),
                    "\\Windows\\Microsoft.net\\Framework64\\v"
                    in event.deep_get("TargetFilename", default=""),
                    "\\Temporary ASP.NET Files\\" in event.deep_get("TargetFilename", default=""),
                    "App_Web_" in event.deep_get("TargetFilename", default=""),
                    event.deep_get("TargetFilename", default="").endswith(".dll"),
                ]
            ),
        ]
    ):
        return True
    return False
