def rule(event):
    if all(
        [
            event.deep_get("Provider_Name", default="") == "Microsoft-Windows-DistributedCOM",
            event.deep_get("EventID", default="") == 10001,
            event.deep_get("param1", default="")
            == "C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe",
            event.deep_get("param2", default="") == 2147943140,
            event.deep_get("param3", default="") == "{054AAE20-4BEA-4347-8A35-64A533254A9D}",
        ]
    ):
        return True
    return False
