def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            event.deep_get("TargetFilename", default="").startswith("/etc/cron.d/"),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/etc/cron.daily/"
                            ),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/etc/cron.hourly/"
                            ),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/etc/cron.monthly/"
                            ),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/etc/cron.weekly/"
                            ),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/var/spool/cron/crontabs/"
                            ),
                            event.deep_get("TargetFilename", default="").startswith(
                                "/var/spool/cron/root"
                            ),
                        ]
                    ),
                    any(
                        [
                            "/etc/cron.allow" in event.deep_get("TargetFilename", default=""),
                            "/etc/cron.deny" in event.deep_get("TargetFilename", default=""),
                            "/etc/crontab" in event.deep_get("TargetFilename", default=""),
                        ]
                    ),
                ]
            ),
            not event.deep_get("TargetFilename", default="")
            in [
                "/etc/cron.daily/apt",
                "/etc/cron.daily/dpkg",
                "/etc/cron.daily/passwd",
                "/etc/crontabs/root",
            ],
        ]
    ):
        return True
    return False
