import re


def rule(event):
    if all(
        [
            event.deep_get("ParentImage", default="").endswith("\\svchost.exe"),
            "-s WebClient" in event.deep_get("ParentCommandLine", default=""),
            event.deep_get("Image", default="").endswith("\\rundll32.exe"),
            "C:\\windows\\system32\\davclnt.dll,DavSetCookie"
            in event.deep_get("CommandLine", default=""),
            re.match(
                r"://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}",
                event.deep_get("CommandLine", default=""),
            ),
            not any(
                [
                    "://10." in event.deep_get("CommandLine", default=""),
                    "://192.168." in event.deep_get("CommandLine", default=""),
                    "://172.16." in event.deep_get("CommandLine", default=""),
                    "://172.17." in event.deep_get("CommandLine", default=""),
                    "://172.18." in event.deep_get("CommandLine", default=""),
                    "://172.19." in event.deep_get("CommandLine", default=""),
                    "://172.20." in event.deep_get("CommandLine", default=""),
                    "://172.21." in event.deep_get("CommandLine", default=""),
                    "://172.22." in event.deep_get("CommandLine", default=""),
                    "://172.23." in event.deep_get("CommandLine", default=""),
                    "://172.24." in event.deep_get("CommandLine", default=""),
                    "://172.25." in event.deep_get("CommandLine", default=""),
                    "://172.26." in event.deep_get("CommandLine", default=""),
                    "://172.27." in event.deep_get("CommandLine", default=""),
                    "://172.28." in event.deep_get("CommandLine", default=""),
                    "://172.29." in event.deep_get("CommandLine", default=""),
                    "://172.30." in event.deep_get("CommandLine", default=""),
                    "://172.31." in event.deep_get("CommandLine", default=""),
                    "://127." in event.deep_get("CommandLine", default=""),
                    "://169.254." in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
