def rule(event):
    if any(
        [
            "BlackWorm" in event.deep_get("Signature", default=""),
            "Chaos" in event.deep_get("Signature", default=""),
            "Cobra" in event.deep_get("Signature", default=""),
            "ContiCrypt" in event.deep_get("Signature", default=""),
            "Crypter" in event.deep_get("Signature", default=""),
            "CRYPTES" in event.deep_get("Signature", default=""),
            "Cryptor" in event.deep_get("Signature", default=""),
            "CylanCrypt" in event.deep_get("Signature", default=""),
            "DelShad" in event.deep_get("Signature", default=""),
            "Destructor" in event.deep_get("Signature", default=""),
            "Filecoder" in event.deep_get("Signature", default=""),
            "GandCrab" in event.deep_get("Signature", default=""),
            "GrandCrab" in event.deep_get("Signature", default=""),
            "Haperlock" in event.deep_get("Signature", default=""),
            "Hiddentear" in event.deep_get("Signature", default=""),
            "HydraCrypt" in event.deep_get("Signature", default=""),
            "Krypt" in event.deep_get("Signature", default=""),
            "Lockbit" in event.deep_get("Signature", default=""),
            "Locker" in event.deep_get("Signature", default=""),
            "Mallox" in event.deep_get("Signature", default=""),
            "Phobos" in event.deep_get("Signature", default=""),
            "Ransom" in event.deep_get("Signature", default=""),
            "Ryuk" in event.deep_get("Signature", default=""),
            "Ryzerlo" in event.deep_get("Signature", default=""),
            "Stopcrypt" in event.deep_get("Signature", default=""),
            "Tescrypt" in event.deep_get("Signature", default=""),
            "TeslaCrypt" in event.deep_get("Signature", default=""),
            "WannaCry" in event.deep_get("Signature", default=""),
            "Xorist" in event.deep_get("Signature", default=""),
        ]
    ):
        return True
    return False
