def rule(event):
    if all(
        [
            "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU\\"
            in event.deep_get("TargetObject", default=""),
            any(
                [
                    "http://" in event.deep_get("Details", default=""),
                    "https://" in event.deep_get("Details", default=""),
                ]
            ),
            any(
                [
                    any(
                        [
                            "account" in event.deep_get("Details", default=""),
                            "anti-bot" in event.deep_get("Details", default=""),
                            "botcheck" in event.deep_get("Details", default=""),
                            "captcha" in event.deep_get("Details", default=""),
                            "challenge" in event.deep_get("Details", default=""),
                            "confirmation" in event.deep_get("Details", default=""),
                            "fraud" in event.deep_get("Details", default=""),
                            "human" in event.deep_get("Details", default=""),
                            "identification" in event.deep_get("Details", default=""),
                            "identificator" in event.deep_get("Details", default=""),
                            "identity" in event.deep_get("Details", default=""),
                            "robot" in event.deep_get("Details", default=""),
                            "validation" in event.deep_get("Details", default=""),
                            "verification" in event.deep_get("Details", default=""),
                            "verify" in event.deep_get("Details", default=""),
                        ]
                    ),
                    any(
                        [
                            "%comspec%" in event.deep_get("Details", default=""),
                            "bitsadmin" in event.deep_get("Details", default=""),
                            "certutil" in event.deep_get("Details", default=""),
                            "cmd" in event.deep_get("Details", default=""),
                            "cscript" in event.deep_get("Details", default=""),
                            "curl" in event.deep_get("Details", default=""),
                            "finger" in event.deep_get("Details", default=""),
                            "mshta" in event.deep_get("Details", default=""),
                            "powershell" in event.deep_get("Details", default=""),
                            "pwsh" in event.deep_get("Details", default=""),
                            "regsvr32" in event.deep_get("Details", default=""),
                            "rundll32" in event.deep_get("Details", default=""),
                            "schtasks" in event.deep_get("Details", default=""),
                            "wget" in event.deep_get("Details", default=""),
                            "wscript" in event.deep_get("Details", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
