def rule(event):
    if event.deep_get("name", default="") in [
        "\\mimidrv",
        "\\lsass",
        "\\windows\\minidump\\",
        "\\hiberfil",
        "\\sqldmpr",
        "\\sam",
        "\\ntds.dit",
        "\\security",
    ]:
        return True
    return False
