def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 8004,
            event.deep_get("WorkstationName", default="")
            in [
                "Rdesktop",
                "Remmina",
                "Freerdp",
                "Windows7",
                "Windows8",
                "Windows2012",
                "Windows2016",
                "Windows2019",
            ],
        ]
    ):
        return True
    return False
