def rule(event):
    if "\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\" in event.deep_get(
        "TargetObject", default=""
    ):
        return True
    return False
