import re


def rule(event):
    if all(
        [
            any(
                [
                    re.match(r"^.*ipconfig.*|.*find.*$", event.deep_get("CommandLine", default="")),
                    re.match(r"^.*net.*|.*find.*$", event.deep_get("CommandLine", default="")),
                    re.match(r"^.*netstat.*|.*find.*$", event.deep_get("CommandLine", default="")),
                    re.match(r"^.*ping.*|.*find.*$", event.deep_get("CommandLine", default="")),
                    re.match(
                        r"^.*systeminfo.*|.*find.*$", event.deep_get("CommandLine", default="")
                    ),
                    re.match(r"^.*tasklist.*|.*find.*$", event.deep_get("CommandLine", default="")),
                    re.match(r"^.*whoami.*|.*find.*$", event.deep_get("CommandLine", default="")),
                ]
            ),
            not all(
                [
                    "cmd.exe /c TASKLIST /V |" in event.deep_get("CommandLine", default=""),
                    "FIND /I" in event.deep_get("CommandLine", default=""),
                    "\\xampp\\" in event.deep_get("CommandLine", default=""),
                    "\\catalina_start.bat" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
