def rule(event):
    if all(
        [
            event.deep_get("EventType", default="") == "CreateKey",
            "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\"
            in event.deep_get("TargetObject", default=""),
            not any(
                [
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Active Setup Temp Folders"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\BranchCache"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Content Indexer Cleaner"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\D3D Shader Cache"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Delivery Optimization Files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\Device Driver Packages"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Diagnostic Data Viewer database files"
                    ),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Downloaded Program Files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\DownloadsFolder"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Feedback Hub Archive log files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\Internet Cache Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Language Pack"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Microsoft Office Temp Files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\Offline Pages Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Old ChkDsk Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Previous Installations"),
                    event.deep_get("TargetObject", default="").endswith("\\Recycle Bin"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\RetailDemo Offline Content"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\Setup Log Files"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\System error memory dump files"
                    ),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\System error minidump files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\Temporary Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Temporary Setup Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Temporary Sync Files"),
                    event.deep_get("TargetObject", default="").endswith("\\Thumbnail Cache"),
                    event.deep_get("TargetObject", default="").endswith("\\Update Cleanup"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Upgrade Discarded Files"
                    ),
                    event.deep_get("TargetObject", default="").endswith("\\User file versions"),
                    event.deep_get("TargetObject", default="").endswith("\\Windows Defender"),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Windows Error Reporting Files"
                    ),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Windows ESD installation files"
                    ),
                    event.deep_get("TargetObject", default="").endswith(
                        "\\Windows Upgrade Log Files"
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
