def rule(event):
    if any(
        [
            "C:\\Windows\\system32\\physmem.sys" in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\System32\\IME\\IMEJP\\imjpueact.dll"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\ime\\IMETC\\IMTCPROT.DLL"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\ime\\SHARED\\imecpmeid.dll"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\config\\spp\\ServiceState\\Recovery\\pac.dat"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\config\\cy-GB\\Setup\\SKB\\InputMethod\\TupTask.dat"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\config\\config\\startwus.dat"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\ime\\SHARED\\WimBootConfigurations.ini"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\ime\\IMEJP\\WimBootConfigurations.ini"
            in event.deep_get("TargetFilename", default=""),
            "C:\\Windows\\system32\\ime\\IMETC\\WimBootConfigurations.ini"
            in event.deep_get("TargetFilename", default=""),
        ]
    ):
        return True
    return False
