def rule(event):
    if event.deep_get("TargetObject", default="").startswith("HKCR\\ms-msdt\\"):
        return True
    return False
