def rule(event):
    if (
        "\\SYSTEM\\CurrentControlSet\\Control\\LsaExtensionConfig\\LsaSrv\\Extensions"
        in event.deep_get("TargetObject", default="")
    ):
        return True
    return False
