def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith(
                ":\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles\\user.exe"
            ),
            "SHA256=B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D"
            in event.deep_get("Hashes", default=""),
        ]
    ):
        return True
    return False
