def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("endpoint", default="") == "spoolss",
                    event.deep_get("operation", default="") == "RpcAddMonitor",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "spoolss",
                    event.deep_get("operation", default="") == "RpcAddPrintProcessor",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "IRemoteWinspool",
                    event.deep_get("operation", default="") == "RpcAsyncAddMonitor",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "IRemoteWinspool",
                    event.deep_get("operation", default="") == "RpcAsyncAddPrintProcessor",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "ISecLogon",
                    event.deep_get("operation", default="") == "SeclCreateProcessWithLogonW",
                ]
            ),
            all(
                [
                    event.deep_get("endpoint", default="") == "ISecLogon",
                    event.deep_get("operation", default="") == "SeclCreateProcessWithLogonExW",
                ]
            ),
        ]
    ):
        return True
    return False
