def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 5136,
            event.deep_get("AttributeLDAPDisplayName", default="") == "gPCMachineExtensionNames",
            any(
                [
                    "827D319E-6EAC-11D2-A4EA-00C04F79F83A"
                    in event.deep_get("AttributeValue", default=""),
                    "803E14A0-B4FB-11D0-A0D0-00A0C90F574B"
                    in event.deep_get("AttributeValue", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
