def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("      .exe"),
                    event.deep_get("Image", default="").endswith("______.exe"),
                    event.deep_get("Image", default="").endswith(".doc.exe"),
                    event.deep_get("Image", default="").endswith(".doc.js"),
                    event.deep_get("Image", default="").endswith(".docx.exe"),
                    event.deep_get("Image", default="").endswith(".docx.js"),
                    event.deep_get("Image", default="").endswith(".gif.exe"),
                    event.deep_get("Image", default="").endswith(".jpeg.exe"),
                    event.deep_get("Image", default="").endswith(".jpg.exe"),
                    event.deep_get("Image", default="").endswith(".mkv.exe"),
                    event.deep_get("Image", default="").endswith(".mov.exe"),
                    event.deep_get("Image", default="").endswith(".mp3.exe"),
                    event.deep_get("Image", default="").endswith(".mp4.exe"),
                    event.deep_get("Image", default="").endswith(".pdf.exe"),
                    event.deep_get("Image", default="").endswith(".pdf.js"),
                    event.deep_get("Image", default="").endswith(".png.exe"),
                    event.deep_get("Image", default="").endswith(".ppt.exe"),
                    event.deep_get("Image", default="").endswith(".ppt.js"),
                    event.deep_get("Image", default="").endswith(".pptx.exe"),
                    event.deep_get("Image", default="").endswith(".pptx.js"),
                    event.deep_get("Image", default="").endswith(".rtf.exe"),
                    event.deep_get("Image", default="").endswith(".rtf.js"),
                    event.deep_get("Image", default="").endswith(".svg.exe"),
                    event.deep_get("Image", default="").endswith(".txt.exe"),
                    event.deep_get("Image", default="").endswith(".txt.js"),
                    event.deep_get("Image", default="").endswith(".xls.exe"),
                    event.deep_get("Image", default="").endswith(".xls.js"),
                    event.deep_get("Image", default="").endswith(".xlsx.exe"),
                    event.deep_get("Image", default="").endswith(".xlsx.js"),
                    event.deep_get("Image", default="").endswith("⠀⠀⠀⠀⠀⠀.exe"),
                ]
            ),
            any(
                [
                    "      .exe" in event.deep_get("CommandLine", default=""),
                    "______.exe" in event.deep_get("CommandLine", default=""),
                    ".doc.exe" in event.deep_get("CommandLine", default=""),
                    ".doc.js" in event.deep_get("CommandLine", default=""),
                    ".docx.exe" in event.deep_get("CommandLine", default=""),
                    ".docx.js" in event.deep_get("CommandLine", default=""),
                    ".gif.exe" in event.deep_get("CommandLine", default=""),
                    ".jpeg.exe" in event.deep_get("CommandLine", default=""),
                    ".jpg.exe" in event.deep_get("CommandLine", default=""),
                    ".mkv.exe" in event.deep_get("CommandLine", default=""),
                    ".mov.exe" in event.deep_get("CommandLine", default=""),
                    ".mp3.exe" in event.deep_get("CommandLine", default=""),
                    ".mp4.exe" in event.deep_get("CommandLine", default=""),
                    ".pdf.exe" in event.deep_get("CommandLine", default=""),
                    ".pdf.js" in event.deep_get("CommandLine", default=""),
                    ".png.exe" in event.deep_get("CommandLine", default=""),
                    ".ppt.exe" in event.deep_get("CommandLine", default=""),
                    ".ppt.js" in event.deep_get("CommandLine", default=""),
                    ".pptx.exe" in event.deep_get("CommandLine", default=""),
                    ".pptx.js" in event.deep_get("CommandLine", default=""),
                    ".rtf.exe" in event.deep_get("CommandLine", default=""),
                    ".rtf.js" in event.deep_get("CommandLine", default=""),
                    ".svg.exe" in event.deep_get("CommandLine", default=""),
                    ".txt.exe" in event.deep_get("CommandLine", default=""),
                    ".txt.js" in event.deep_get("CommandLine", default=""),
                    ".xls.exe" in event.deep_get("CommandLine", default=""),
                    ".xls.js" in event.deep_get("CommandLine", default=""),
                    ".xlsx.exe" in event.deep_get("CommandLine", default=""),
                    ".xlsx.js" in event.deep_get("CommandLine", default=""),
                    "⠀⠀⠀⠀⠀⠀.exe" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
