def rule(event):
    if any(
        [
            "IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7" in event.deep_get("Hashes", default=""),
            any(
                [
                    event.deep_get("ImageLoaded", default="").endswith("\\WinRing0x64.sys"),
                    event.deep_get("ImageLoaded", default="").endswith("\\WinRing0.sys"),
                    event.deep_get("ImageLoaded", default="").endswith("\\WinRing0.dll"),
                    event.deep_get("ImageLoaded", default="").endswith("\\WinRing0x64.dll"),
                    event.deep_get("ImageLoaded", default="").endswith("\\winring00x64.sys"),
                ]
            ),
        ]
    ):
        return True
    return False
