def rule(event):
    if any(
        [
            any(
                [
                    "lsass.dmp" in event.deep_get("CommandLine", default=""),
                    "lsass.zip" in event.deep_get("CommandLine", default=""),
                    "lsass.rar" in event.deep_get("CommandLine", default=""),
                    "Andrew.dmp" in event.deep_get("CommandLine", default=""),
                    "Coredump.dmp" in event.deep_get("CommandLine", default=""),
                    "NotLSASS.zip" in event.deep_get("CommandLine", default=""),
                    "lsass_2" in event.deep_get("CommandLine", default=""),
                    "lsassdump" in event.deep_get("CommandLine", default=""),
                    "lsassdmp" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    "lsass" in event.deep_get("CommandLine", default=""),
                    ".dmp" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    "SQLDmpr" in event.deep_get("CommandLine", default=""),
                    ".mdmp" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    "nanodump" in event.deep_get("CommandLine", default=""),
                    ".dmp" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
