def rule(event):
    if any(
        [
            any(
                [
                    ":\\RECYCLER\\" in event.deep_get("Image", default=""),
                    ":\\SystemVolumeInformation\\" in event.deep_get("Image", default=""),
                ]
            ),
            any(
                [
                    event.deep_get("Image", default="").startswith("C:\\Windows\\Tasks\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\debug\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\fonts\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\help\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\drivers\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\addins\\"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\cursors\\"),
                    event.deep_get("Image", default="").startswith(
                        "C:\\Windows\\system32\\tasks\\"
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
