def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 300,
            event.deep_get("TargetUserSid", default="").startswith("S-1-5-21-"),
            any(
                [
                    "S-1-5-32-544" in event.deep_get("SidList", default=""),
                    "-500}" in event.deep_get("SidList", default=""),
                    "-518}" in event.deep_get("SidList", default=""),
                    "-519}" in event.deep_get("SidList", default=""),
                ]
            ),
            not any(
                [
                    event.deep_get("TargetUserSid", default="").endswith("-500"),
                    event.deep_get("TargetUserSid", default="").endswith("-518"),
                    event.deep_get("TargetUserSid", default="").endswith("-519"),
                ]
            ),
        ]
    ):
        return True
    return False
