def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") in [3082, 3083],
            not event.deep_get("FileNameBuffer", default="")
            in ["system32\\drivers\\vsock.sys", "System32\\drivers\\vmci.sys"],
        ]
    ):
        return True
    return False
