def rule(event):
    if any(
        [
            event.deep_get("TargetFilename", default="").endswith("/11111.tar"),
            event.deep_get("TargetFilename", default="").endswith("/aacore.sh"),
            event.deep_get("TargetFilename", default="").endswith("/appcheck.sh"),
            event.deep_get("TargetFilename", default="").endswith("/autoins"),
            event.deep_get("TargetFilename", default="").endswith("/BarracudaMailService"),
            event.deep_get("TargetFilename", default="").endswith("/etc/cron.daily/core_check.sh"),
            event.deep_get("TargetFilename", default="").endswith("/etc/cron.daily/core.sh"),
            event.deep_get("TargetFilename", default="").endswith("/etc/cron.hourly/aacore.sh"),
            event.deep_get("TargetFilename", default="").endswith("/etc/cron.hourly/appcheck.sh"),
            event.deep_get("TargetFilename", default="").endswith("/etc/cron.hourly/core.sh"),
            event.deep_get("TargetFilename", default="").endswith("/get_fs_info.pl"),
            event.deep_get("TargetFilename", default="").endswith("/imgdata.jpg"),
            event.deep_get("TargetFilename", default="").endswith("/install_att_v2.tar"),
            event.deep_get("TargetFilename", default="").endswith("/install_bvp74_auth.tar"),
            event.deep_get("TargetFilename", default="").endswith("/install_helo.tar"),
            event.deep_get("TargetFilename", default="").endswith("/install_reuse.tar"),
            event.deep_get("TargetFilename", default="").endswith("/intent_helo"),
            event.deep_get("TargetFilename", default="").endswith("/intent_reuse"),
            event.deep_get("TargetFilename", default="").endswith("/intentbas"),
            event.deep_get("TargetFilename", default="").endswith("/mod_attachment.lua"),
            event.deep_get("TargetFilename", default="").endswith("/mod_content.lua"),
            event.deep_get("TargetFilename", default="").endswith("/mod_require_helo.lua"),
            event.deep_get("TargetFilename", default="").endswith("/mod_rtf"),
            event.deep_get("TargetFilename", default="").endswith("/mod_sender.lua"),
            event.deep_get("TargetFilename", default="").endswith("/mod_udp.so"),
            event.deep_get("TargetFilename", default="").endswith("/nfsd_stub.ko"),
            event.deep_get("TargetFilename", default="").endswith("/resize_reisertab"),
            event.deep_get("TargetFilename", default="").endswith("/resize_risertab"),
            event.deep_get("TargetFilename", default="").endswith("/resize2fstab"),
            event.deep_get("TargetFilename", default="").endswith("/rverify"),
            event.deep_get("TargetFilename", default="").endswith("/saslautchd"),
            event.deep_get("TargetFilename", default="").endswith("/sendscd"),
            event.deep_get("TargetFilename", default="").endswith("/snapshot.tar"),
            event.deep_get("TargetFilename", default="").endswith("/tmp/p"),
            event.deep_get("TargetFilename", default="").endswith("/tmp/p7"),
            event.deep_get("TargetFilename", default="").endswith("/tmp/t"),
            event.deep_get("TargetFilename", default="").endswith("/update_v2.sh"),
            event.deep_get("TargetFilename", default="").endswith("/update_v31.sh"),
            event.deep_get("TargetFilename", default="").endswith("/update_v35.sh"),
            event.deep_get("TargetFilename", default="").endswith("/update_version"),
        ]
    ):
        return True
    return False
