def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("Image", default="") == "/bin/launchctl",
                    "unload" in event.deep_get("CommandLine", default=""),
                    any(
                        [
                            "com.objective-see.lulu.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.objective-see.blockblock.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.google.santad.plist" in event.deep_get("CommandLine", default=""),
                            "com.carbonblack.defense.daemon.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.carbonblack.daemon.plist"
                            in event.deep_get("CommandLine", default=""),
                            "at.obdev.littlesnitchd.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.tenablesecurity.nessusagent.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.opendns.osx.RoamingClientConfigUpdater.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.crowdstrike.falcond.plist"
                            in event.deep_get("CommandLine", default=""),
                            "com.crowdstrike.userdaemon.plist"
                            in event.deep_get("CommandLine", default=""),
                            "osquery" in event.deep_get("CommandLine", default=""),
                            "filebeat" in event.deep_get("CommandLine", default=""),
                            "auditbeat" in event.deep_get("CommandLine", default=""),
                            "packetbeat" in event.deep_get("CommandLine", default=""),
                            "td-agent" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="") == "/usr/sbin/spctl",
                    "disable" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
