def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 4663,
            event.deep_get("ObjectServer", default="") == "Security",
            event.deep_get("ObjectType", default="") == "File",
            event.deep_get("ObjectName", default="").startswith("\\Device\\CdRom"),
            not event.deep_get("ObjectName", default="")
            in [
                "\\Device\\CdRom0\\autorun.ico",
                "\\Device\\CdRom0\\setup.exe",
                "\\Device\\CdRom0\\setup64.exe",
            ],
        ]
    ):
        return True
    return False
