import re


def rule(event):
    if all(
        [
            any(
                [
                    "com.apple.WebKit.WebContent" in event.deep_get("ParentImage", default=""),
                    "firefox" in event.deep_get("ParentImage", default=""),
                    "Google Chrome Helper" in event.deep_get("ParentImage", default=""),
                    "Google Chrome" in event.deep_get("ParentImage", default=""),
                    "Microsoft Edge" in event.deep_get("ParentImage", default=""),
                    "Opera" in event.deep_get("ParentImage", default=""),
                    "Safari" in event.deep_get("ParentImage", default=""),
                    "Tor Browser" in event.deep_get("ParentImage", default=""),
                ]
            ),
            any(
                [
                    event.deep_get("Image", default="").endswith("/bash"),
                    event.deep_get("Image", default="").endswith("/curl"),
                    event.deep_get("Image", default="").endswith("/dash"),
                    event.deep_get("Image", default="").endswith("/ksh"),
                    event.deep_get("Image", default="").endswith("/osascript"),
                    event.deep_get("Image", default="").endswith("/perl"),
                    event.deep_get("Image", default="").endswith("/php"),
                    event.deep_get("Image", default="").endswith("/pwsh"),
                    event.deep_get("Image", default="").endswith("/python"),
                    event.deep_get("Image", default="").endswith("/sh"),
                    event.deep_get("Image", default="").endswith("/tcsh"),
                    event.deep_get("Image", default="").endswith("/wget"),
                    event.deep_get("Image", default="").endswith("/zsh"),
                ]
            ),
            not any(
                [
                    "--defaults-torrc" in event.deep_get("CommandLine", default=""),
                    re.match(
                        r"^.*/Library/Application Support/Microsoft/MAU.*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate.*$",
                        event.deep_get("CommandLine", default=""),
                    ),
                    all(
                        [
                            any(
                                [
                                    "Google Chrome Helper"
                                    in event.deep_get("ParentImage", default=""),
                                    "Google Chrome" in event.deep_get("ParentImage", default=""),
                                ]
                            ),
                            any(
                                [
                                    re.match(
                                        r"^.*/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/.*/Resources/install.sh.*$",
                                        event.deep_get("CommandLine", default=""),
                                    ),
                                    re.match(
                                        r"^.*/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/.*/Resources/keystone_promote_preflight.sh.*$",
                                        event.deep_get("CommandLine", default=""),
                                    ),
                                    re.match(
                                        r"^.*/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/.*/Resources/keystone_promote_postflight.sh.*$",
                                        event.deep_get("CommandLine", default=""),
                                    ),
                                ]
                            ),
                        ]
                    ),
                    all(
                        [
                            "Microsoft Edge" in event.deep_get("ParentImage", default=""),
                            any(
                                [
                                    "IOPlatformExpertDevice"
                                    in event.deep_get("CommandLine", default=""),
                                    "hw.model" in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                        ]
                    ),
                    all(
                        [
                            any(
                                [
                                    "Google Chrome Helper"
                                    in event.deep_get("ParentImage", default=""),
                                    "Google Chrome" in event.deep_get("ParentImage", default=""),
                                ]
                            ),
                            "/Users/" in event.deep_get("CommandLine", default=""),
                            "/Library/Application Support/Google/Chrome/recovery/"
                            in event.deep_get("CommandLine", default=""),
                            "/ChromeRecovery" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    event.deep_get("CommandLine", default="") == "",
                    event.deep_get("CommandLine", default="") == "",
                ]
            ),
        ]
    ):
        return True
    return False
