def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("OriginalFileName", default="") == "python.exe",
                    any(
                        [
                            event.deep_get("Image", default="").endswith("python.exe"),
                            event.deep_get("Image", default="").endswith("python3.exe"),
                            event.deep_get("Image", default="").endswith("python2.exe"),
                        ]
                    ),
                ]
            ),
            " -c" in event.deep_get("CommandLine", default=""),
            not any(
                [
                    all(
                        [
                            any(
                                [
                                    event.deep_get("ParentImage", default="").startswith(
                                        "C:\\Program Files\\Python"
                                    ),
                                    event.deep_get("ParentImage", default="").startswith(
                                        "C:\\Program Files (x86)\\Python"
                                    ),
                                ]
                            ),
                            event.deep_get("ParentImage", default="").endswith("\\python.exe"),
                            "-E -s -m ensurepip -U --default-pip"
                            in event.deep_get("ParentCommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            any(
                                [
                                    event.deep_get("ParentImage", default="").startswith(
                                        "C:\\Program Files\\Python"
                                    ),
                                    event.deep_get("ParentImage", default="").startswith(
                                        "C:\\Program Files (x86)\\Python"
                                    ),
                                ]
                            ),
                            "-W ignore::DeprecationWarning"
                            in event.deep_get("CommandLine", default=""),
                            "['install', '--no-cache-dir', '--no-index', '--find-links',"
                            in event.deep_get("CommandLine", default=""),
                            "'--upgrade', 'pip'" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    any(
                        [
                            event.deep_get("ParentImage", default="").endswith(
                                "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
                            ),
                            event.deep_get("ParentImage", default="")
                            in [
                                "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                                "C:\\Program Files (x86)\\Microsoft VS Code\\Code.exe",
                            ],
                        ]
                    ),
                    all(
                        [
                            "<pip-setuptools-caller>" in event.deep_get("CommandLine", default=""),
                            "exec(compile(" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
