def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") in [4656, 4663],
            event.deep_get("ProcessName", default="").endswith("\\OUTLOOK.EXE"),
            "\\REGISTRY\\MACHINE\\SYSTEM" in event.deep_get("ObjectName", default=""),
            "Services\\" in event.deep_get("ObjectName", default=""),
            any(
                [
                    event.deep_get("ObjectName", default="").endswith("WebClient\\NetworkProvider"),
                    event.deep_get("ObjectName", default="").endswith(
                        "LanmanWorkstation\\NetworkProvider"
                    ),
                ]
            ),
            "%%4416" in event.deep_get("AccessList", default=""),
        ]
    ):
        return True
    return False
