import json


def rule(event):
    if all(
        [
            any(
                [
                    "dpapi::masterkey" in json.dumps(event.to_dict()),
                    "eo.oe.kiwi" in json.dumps(event.to_dict()),
                    "event::clear" in json.dumps(event.to_dict()),
                    "event::drop" in json.dumps(event.to_dict()),
                    "gentilkiwi.com" in json.dumps(event.to_dict()),
                    "kerberos::golden" in json.dumps(event.to_dict()),
                    "kerberos::ptc" in json.dumps(event.to_dict()),
                    "kerberos::ptt" in json.dumps(event.to_dict()),
                    "kerberos::tgt" in json.dumps(event.to_dict()),
                    "Kiwi Legit Printer" in json.dumps(event.to_dict()),
                    "lsadump::" in json.dumps(event.to_dict()),
                    "mimidrv.sys" in json.dumps(event.to_dict()),
                    "\\mimilib.dll" in json.dumps(event.to_dict()),
                    "misc::printnightmare" in json.dumps(event.to_dict()),
                    "misc::shadowcopies" in json.dumps(event.to_dict()),
                    "misc::skeleton" in json.dumps(event.to_dict()),
                    "privilege::backup" in json.dumps(event.to_dict()),
                    "privilege::debug" in json.dumps(event.to_dict()),
                    "privilege::driver" in json.dumps(event.to_dict()),
                    "sekurlsa::" in json.dumps(event.to_dict()),
                ]
            ),
            not event.deep_get("EventID", default="") == 15,
        ]
    ):
        return True
    return False
