def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            any(
                                [
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\DserNamePipe"
                                    ),
                                    event.deep_get("PipeName", default="").startswith("\\f4c3"),
                                    event.deep_get("PipeName", default="").startswith("\\f53f"),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\fullduplex_"
                                    ),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\mojo.5688.8052.183894939787088877"
                                    ),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\mojo.5688.8052.35780273329370473"
                                    ),
                                    event.deep_get("PipeName", default="").startswith("\\MsFteWds"),
                                    event.deep_get("PipeName", default="").startswith("\\msrpc_"),
                                    event.deep_get("PipeName", default="").startswith("\\mypipe-f"),
                                    event.deep_get("PipeName", default="").startswith("\\mypipe-h"),
                                    event.deep_get("PipeName", default="").startswith("\\ntsvcs"),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\PGMessagePipe"
                                    ),
                                    event.deep_get("PipeName", default="").startswith("\\rpc_"),
                                    event.deep_get("PipeName", default="").startswith("\\scerpc"),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\SearchTextHarvester"
                                    ),
                                    event.deep_get("PipeName", default="").startswith("\\spoolss"),
                                    event.deep_get("PipeName", default="").startswith("\\win_svc"),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\win\\msrpc_"
                                    ),
                                    event.deep_get("PipeName", default="").startswith(
                                        "\\windows.update.manager"
                                    ),
                                    event.deep_get("PipeName", default="").startswith("\\wkssvc"),
                                ]
                            ),
                            event.deep_get("PipeName", default="")
                            in ["\\demoagent_11", "\\demoagent_22"],
                        ]
                    ),
                    all(
                        [
                            event.deep_get("PipeName", default="").startswith(
                                "\\Winsock2\\CatalogChangeListener-"
                            ),
                            event.deep_get("PipeName", default="").endswith("-0,"),
                        ]
                    ),
                ]
            ),
            not event.deep_get("PipeName", default="")
            in [
                "\\wkssvc",
                "\\spoolss",
                "\\scerpc",
                "\\ntsvcs",
                "\\SearchTextHarvester",
                "\\PGMessagePipe",
                "\\MsFteWds",
            ],
            not all(
                [
                    any(
                        [
                            ":\\Program Files\\Websense\\" in event.deep_get("Image", default=""),
                            ":\\Program Files (x86)\\Websense\\"
                            in event.deep_get("Image", default=""),
                        ]
                    ),
                    any(
                        [
                            event.deep_get("PipeName", default="").startswith("\\DserNamePipeR"),
                            event.deep_get("PipeName", default="").startswith("\\DserNamePipeW"),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
