def rule(event):
    if all(
        [
            "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\"
            in event.deep_get("TargetObject", default=""),
            any(
                [
                    event.deep_get("TargetObject", default="").endswith("\\csrss.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\dllhost.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\explorer.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\RuntimeBroker.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\services.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\sihost.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\svchost.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\taskhostw.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\winlogon.exe"),
                    event.deep_get("TargetObject", default="").endswith("\\WmiPrvSe.exe"),
                ]
            ),
        ]
    ):
        return True
    return False
