import re


def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 5145,
            re.match(r"^\\\\\\.*\\IPC$$", event.deep_get("ShareName", default="")),
            not event.deep_get("RelativeTargetName", default="")
            in [
                "atsvc",
                "samr",
                "lsarpc",
                "lsass",
                "winreg",
                "netlogon",
                "srvsvc",
                "protected_storage",
                "wkssvc",
                "browser",
                "netdfs",
                "svcctl",
                "spoolss",
                "ntsvcs",
                "LSM_API_service",
                "HydraLsPipe",
                "TermSrv_API_service",
                "MsFteWds",
                "sql\\query",
                "eventlog",
            ],
        ]
    ):
        return True
    return False
