def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            " /AutoIt3ExecuteScript" in event.deep_get("CommandLine", default=""),
                            " /ErrorStdOut" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "IMPHASH=FDC554B3A8683918D731685855683DDF"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=CD30A61B60B3D60CECDB034C8C83C290"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000"
                            in event.deep_get("Hashes", default=""),
                        ]
                    ),
                    event.deep_get("OriginalFileName", default="")
                    in ["AutoIt3.exe", "AutoIt2.exe", "AutoIt.exe"],
                ]
            ),
            not any(
                [
                    event.deep_get("Image", default="").endswith("\\AutoIt.exe"),
                    event.deep_get("Image", default="").endswith("\\AutoIt2.exe"),
                    event.deep_get("Image", default="").endswith("\\AutoIt3_x64.exe"),
                    event.deep_get("Image", default="").endswith("\\AutoIt3.exe"),
                ]
            ),
        ]
    ):
        return True
    return False
