def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\rundll32.exe"),
                    event.deep_get("OriginalFileName", default="") == "RUNDLL32.EXE",
                ]
            ),
            not any(
                [
                    event.deep_get("CommandLine", default="") == "",
                    event.deep_get("CommandLine", default="") == "",
                    any(
                        [
                            any(
                                [
                                    ".cpl " in event.deep_get("CommandLine", default=""),
                                    ".cpl," in event.deep_get("CommandLine", default=""),
                                    '.cpl"' in event.deep_get("CommandLine", default=""),
                                    ".cpl'" in event.deep_get("CommandLine", default=""),
                                    ".dll " in event.deep_get("CommandLine", default=""),
                                    ".dll," in event.deep_get("CommandLine", default=""),
                                    '.dll"' in event.deep_get("CommandLine", default=""),
                                    ".dll'" in event.deep_get("CommandLine", default=""),
                                    ".inf " in event.deep_get("CommandLine", default=""),
                                    ".inf," in event.deep_get("CommandLine", default=""),
                                    '.inf"' in event.deep_get("CommandLine", default=""),
                                    ".inf'" in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    event.deep_get("CommandLine", default="").endswith(".cpl"),
                                    event.deep_get("CommandLine", default="").endswith(".dll"),
                                    event.deep_get("CommandLine", default="").endswith(".inf"),
                                ]
                            ),
                        ]
                    ),
                    " -localserver " in event.deep_get("CommandLine", default=""),
                    all(
                        [
                            event.deep_get("ParentImage", default="").endswith("\\msiexec.exe"),
                            ":\\Windows\\Installer\\" in event.deep_get("CommandLine", default=""),
                            ".tmp" in event.deep_get("CommandLine", default=""),
                            "zzzzInvokeManagedCustomActionOutOfProc"
                            in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            not all(
                [
                    ":\\Users\\" in event.deep_get("ParentCommandLine", default=""),
                    "\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{"
                    in event.deep_get("ParentCommandLine", default=""),
                    "\\EDGEMITMP_" in event.deep_get("ParentCommandLine", default=""),
                    ".tmp\\setup.exe" in event.deep_get("ParentCommandLine", default=""),
                    "--install-archive=" in event.deep_get("ParentCommandLine", default=""),
                    "--previous-version=" in event.deep_get("ParentCommandLine", default=""),
                    "--msedgewebview --verbose-logging --do-not-launch-msedge --user-level"
                    in event.deep_get("ParentCommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
