import re


def rule(event):
    if any(
        [
            any(
                [
                    "C:\\Windows\\cert.exe" in event.deep_get("CommandLine", default=""),
                    "del /q /f c:\\kworking\\agent.crt"
                    in event.deep_get("CommandLine", default=""),
                    "Kaseya VSA Agent Hot-fix" in event.deep_get("CommandLine", default=""),
                    "\\AppData\\Local\\Temp\\MsMpEng.exe"
                    in event.deep_get("CommandLine", default=""),
                    "rmdir /s /q %SystemDrive%\\inetpub\\logs"
                    in event.deep_get("CommandLine", default=""),
                    re.match(
                        r"^.*del /s /q /f %SystemDrive%\\.*.log.*$",
                        event.deep_get("CommandLine", default=""),
                    ),
                    "c:\\kworking1\\agent.exe" in event.deep_get("CommandLine", default=""),
                    "c:\\kworking1\\agent.crt" in event.deep_get("CommandLine", default=""),
                ]
            ),
            event.deep_get("Image", default="")
            in [
                "C:\\Windows\\MsMpEng.exe",
                "C:\\Windows\\cert.exe",
                "C:\\kworking\\agent.exe",
                "C:\\kworking1\\agent.exe",
            ],
            all(
                [
                    "del /s /q /f" in event.deep_get("CommandLine", default=""),
                    "WebPages\\Errors\\webErrorLog.txt"
                    in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
