def rule(event):
    if any(
        [
            all(
                [
                    "C:\\Windows\\Temp\\ScreenConnect\\"
                    in event.deep_get("TargetFilename", default=""),
                    "\\LB3.exe" in event.deep_get("TargetFilename", default=""),
                ]
            ),
            any(
                [
                    "C:\\mpyutd.msi" in event.deep_get("TargetFilename", default=""),
                    "C:\\perflogs\\RunSchedulerTaskOnce.ps1"
                    in event.deep_get("TargetFilename", default=""),
                    "C:\\ProgramData\\1.msi" in event.deep_get("TargetFilename", default=""),
                    "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mpyutd.msi"
                    in event.deep_get("TargetFilename", default=""),
                    "C:\\ProgramData\\update.dat" in event.deep_get("TargetFilename", default=""),
                    "C:\\Users\\oldadmin\\Documents\\MilsoftConnect\\Files\\ta.exe"
                    in event.deep_get("TargetFilename", default=""),
                    "C:\\Windows\\Help\\Help\\SentinelAgentCore.dll"
                    in event.deep_get("TargetFilename", default=""),
                    "C:\\Windows\\Help\\Help\\SentinelUI.exe"
                    in event.deep_get("TargetFilename", default=""),
                    "C:\\Windows\\spsrv.exe" in event.deep_get("TargetFilename", default=""),
                    "C:\\Windows\\Temp\\svchost.exe"
                    in event.deep_get("TargetFilename", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
