import re


def rule(event):
    if re.match(
        r"(Copy-Item|cpi) .{2,128} -Destination .{1,32}\\\\Windows\\\\(System32|SysWOW64)",
        event.deep_get("ScriptBlockText", default=""),
    ):
        return True
    return False
