def rule(event):
    if "\\SYSTEM\\CurrentControlSet\\services\\null\\Instance" in event.deep_get(
        "TargetObject", default=""
    ):
        return True
    return False
