def rule(event):
    if "Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe" in event.deep_get(
        "TargetObject", default=""
    ):
        return True
    return False
