def rule(event):
    if any(
        [
            any(
                [
                    event.deep_get("TargetFilename", default="").endswith("\\Temp\\sam"),
                    event.deep_get("TargetFilename", default="").endswith("\\sam.sav"),
                    event.deep_get("TargetFilename", default="").endswith("\\Intel\\sam"),
                    event.deep_get("TargetFilename", default="").endswith("\\sam.hive"),
                    event.deep_get("TargetFilename", default="").endswith("\\Perflogs\\sam"),
                    event.deep_get("TargetFilename", default="").endswith("\\ProgramData\\sam"),
                    event.deep_get("TargetFilename", default="").endswith("\\Users\\Public\\sam"),
                    event.deep_get("TargetFilename", default="").endswith("\\AppData\\Local\\sam"),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\AppData\\Roaming\\sam"
                    ),
                    event.deep_get("TargetFilename", default="").endswith("_ShadowSteal.zip"),
                    event.deep_get("TargetFilename", default="").endswith(
                        "\\Documents\\SAM.export"
                    ),
                    event.deep_get("TargetFilename", default="").endswith(":\\sam"),
                ]
            ),
            any(
                [
                    "\\hive_sam_" in event.deep_get("TargetFilename", default=""),
                    "\\sam.save" in event.deep_get("TargetFilename", default=""),
                    "\\sam.export" in event.deep_get("TargetFilename", default=""),
                    "\\~reg_sam.save" in event.deep_get("TargetFilename", default=""),
                    "\\sam_backup" in event.deep_get("TargetFilename", default=""),
                    "\\sam.bck" in event.deep_get("TargetFilename", default=""),
                    "\\sam.backup" in event.deep_get("TargetFilename", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
