def rule(event):
    if all(
        [
            event.deep_get("Image", default="").endswith("\\schtasks.exe"),
            any(
                [
                    " /change " in event.deep_get("CommandLine", default=""),
                    " /create " in event.deep_get("CommandLine", default=""),
                ]
            ),
            "/ru " in event.deep_get("CommandLine", default=""),
            any(
                [
                    "NT AUT" in event.deep_get("CommandLine", default=""),
                    " SYSTEM " in event.deep_get("CommandLine", default=""),
                ]
            ),
            not any(
                [
                    all(
                        [
                            event.deep_get("Image", default="").endswith("\\schtasks.exe"),
                            "/TN TVInstallRestore" in event.deep_get("CommandLine", default=""),
                            "\\TeamViewer_.exe" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "Subscription Heartbeat" in event.deep_get("CommandLine", default=""),
                            "\\HeartbeatConfig.xml" in event.deep_get("CommandLine", default=""),
                            "\\Microsoft Shared\\OFFICE"
                            in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR "
                            in event.deep_get("CommandLine", default=""),
                            ":\\Program Files (x86)\\Avira\\System Speedup\\setup\\avira_speedup_setup.exe"
                            in event.deep_get("CommandLine", default=""),
                            '/VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART" /RL HIGHEST'
                            in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
