def rule(event):
    if all(
        [
            " = ServerRemoteHost " in event.deep_get("ContextInfo", default=""),
            "wsmprovhost.exe" in event.deep_get("ContextInfo", default=""),
            not "\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psm1"
            in event.deep_get("ContextInfo", default=""),
        ]
    ):
        return True
    return False
