def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("Image", default="").endswith("\\CamMute.exe"),
                    not any(
                        [
                            "\\Lenovo\\Communication Utility\\"
                            in event.deep_get("Image", default=""),
                            "\\Lenovo\\Communications Utility\\"
                            in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\chrome_frame_helper.exe"),
                    not "\\Google\\Chrome\\application\\" in event.deep_get("Image", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\dvcemumanager.exe"),
                    not "\\Microsoft Device Emulator\\" in event.deep_get("Image", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\Gadget.exe"),
                    not "\\Windows Media Player\\" in event.deep_get("Image", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\hcc.exe"),
                    not "\\HTML Help Workshop\\" in event.deep_get("Image", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\hkcmd.exe"),
                    not any(
                        [
                            "\\System32\\" in event.deep_get("Image", default=""),
                            "\\SysNative\\" in event.deep_get("Image", default=""),
                            "\\SysWow64\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\Mc.exe"),
                    not any(
                        [
                            "\\Microsoft Visual Studio" in event.deep_get("Image", default=""),
                            "\\Microsoft SDK" in event.deep_get("Image", default=""),
                            "\\Windows Kit" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\MsMpEng.exe"),
                    not any(
                        [
                            "\\Microsoft Security Client\\" in event.deep_get("Image", default=""),
                            "\\Windows Defender\\" in event.deep_get("Image", default=""),
                            "\\AntiMalware\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\msseces.exe"),
                    not any(
                        [
                            "\\Microsoft Security Center\\" in event.deep_get("Image", default=""),
                            "\\Microsoft Security Client\\" in event.deep_get("Image", default=""),
                            "\\Microsoft Security Essentials\\"
                            in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\OInfoP11.exe"),
                    not "\\Common Files\\Microsoft Shared\\" in event.deep_get("Image", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\OleView.exe"),
                    not any(
                        [
                            "\\Microsoft Visual Studio" in event.deep_get("Image", default=""),
                            "\\Microsoft SDK" in event.deep_get("Image", default=""),
                            "\\Windows Kit" in event.deep_get("Image", default=""),
                            "\\Windows Resource Kit\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
            all(
                [
                    event.deep_get("Image", default="").endswith("\\rc.exe"),
                    not any(
                        [
                            "\\Microsoft Visual Studio" in event.deep_get("Image", default=""),
                            "\\Microsoft SDK" in event.deep_get("Image", default=""),
                            "\\Windows Kit" in event.deep_get("Image", default=""),
                            "\\Windows Resource Kit\\" in event.deep_get("Image", default=""),
                            "\\Microsoft.NET\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
