def rule(event):
    if "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntkd" in event.deep_get(
        "TargetObject", default=""
    ):
        return True
    return False
