def rule(event):
    if all(
        [
            "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
            in event.deep_get("TargetObject", default=""),
            not event.deep_get("TargetObject", default="").endswith("\\MRUList"),
            not any(
                [
                    "ping" in event.deep_get("Details", default=""),
                    event.deep_get("Details", default="")
                    in [
                        "%appdata%\\1",
                        "%localappdata%\\1",
                        "%public%\\1",
                        "%temp%\\1",
                        "calc\\1",
                        "dxdiag\\1",
                        "explorer\\1",
                        "gpedit.msc\\1",
                        "mmc\\1",
                        "notepad\\1",
                        "regedit\\1",
                        "services.msc\\1",
                        "winver\\1",
                    ],
                ]
            ),
        ]
    ):
        return True
    return False
