def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") in [4672, 4964],
            not any(
                [
                    event.deep_get("SubjectUserSid", default="") == "S-1-5-18",
                    event.deep_get("SubjectUserName", default="") == "%Admins_Workstations%",
                ]
            ),
        ]
    ):
        return True
    return False
