def rule(event):
    if any(
        [
            event.deep_get("TargetFilename", default="").endswith(":\\$Recycle.Bin.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\Documents and Settings.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\MSOCache.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\PerfLogs.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\Recovery.exe"),
            event.deep_get("TargetFilename", default="").endswith(".bat.exe"),
            event.deep_get("TargetFilename", default="").endswith(".sys.exe"),
        ]
    ):
        return True
    return False
