def rule(event):
    if any(
        [
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\axeonoffhelper.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\cdpsgshims.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(":\\Windows\\System32\\oci.dll"),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\offdmpsvc.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\shellchromeapi.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\TSMSISrv.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\TSVIPSrv.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\wbem\\wbemcomn.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\WLBSCTRL.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\wow64log.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\Windows\\System32\\WptsExtensions.dll"
            ),
            event.deep_get("TargetFilename", default="").endswith("\\SprintCSP.dll"),
        ]
    ):
        return True
    return False
