def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\curl.exe"),
                    event.deep_get("Product", default="") == "The curl executable",
                ]
            ),
            any(
                [
                    any(
                        [
                            "%AppData%" in event.deep_get("CommandLine", default=""),
                            "%Public%" in event.deep_get("CommandLine", default=""),
                            "%Temp%" in event.deep_get("CommandLine", default=""),
                            "%tmp%" in event.deep_get("CommandLine", default=""),
                            "\\AppData\\" in event.deep_get("CommandLine", default=""),
                            "\\Desktop\\" in event.deep_get("CommandLine", default=""),
                            "\\Temp\\" in event.deep_get("CommandLine", default=""),
                            "\\Users\\Public\\" in event.deep_get("CommandLine", default=""),
                            "C:\\PerfLogs\\" in event.deep_get("CommandLine", default=""),
                            "C:\\ProgramData\\" in event.deep_get("CommandLine", default=""),
                            "C:\\Windows\\Temp\\" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            event.deep_get("CommandLine", default="").endswith(".dll"),
                            event.deep_get("CommandLine", default="").endswith(".gif"),
                            event.deep_get("CommandLine", default="").endswith(".jpeg"),
                            event.deep_get("CommandLine", default="").endswith(".jpg"),
                            event.deep_get("CommandLine", default="").endswith(".png"),
                            event.deep_get("CommandLine", default="").endswith(".temp"),
                            event.deep_get("CommandLine", default="").endswith(".tmp"),
                            event.deep_get("CommandLine", default="").endswith(".txt"),
                            event.deep_get("CommandLine", default="").endswith(".vbe"),
                            event.deep_get("CommandLine", default="").endswith(".vbs"),
                        ]
                    ),
                ]
            ),
            not all(
                [
                    event.deep_get("ParentImage", default="")
                    == "C:\\Program Files\\Git\\usr\\bin\\sh.exe",
                    event.deep_get("Image", default="")
                    == "C:\\Program Files\\Git\\mingw64\\bin\\curl.exe",
                    "--silent --show-error --output " in event.deep_get("CommandLine", default=""),
                    "gfw-httpget-" in event.deep_get("CommandLine", default=""),
                    "AppData" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
