def rule(event):
    if all(
        [
            any(
                [
                    "\\Software\\Wow6432Node\\Microsoft\\Office"
                    in event.deep_get("TargetObject", default=""),
                    "\\Software\\Microsoft\\Office" in event.deep_get("TargetObject", default=""),
                ]
            ),
            any(
                [
                    "\\Word\\Addins" in event.deep_get("TargetObject", default=""),
                    "\\PowerPoint\\Addins" in event.deep_get("TargetObject", default=""),
                    "\\Outlook\\Addins" in event.deep_get("TargetObject", default=""),
                    "\\Onenote\\Addins" in event.deep_get("TargetObject", default=""),
                    "\\Excel\\Addins" in event.deep_get("TargetObject", default=""),
                    "\\Access\\Addins" in event.deep_get("TargetObject", default=""),
                    "test\\Special\\Perf" in event.deep_get("TargetObject", default=""),
                ]
            ),
            not any(
                [
                    event.deep_get("Details", default="") == "(Empty)",
                    event.deep_get("Details", default="") == "",
                    all(
                        [
                            any(
                                [
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files\\Microsoft Office\\"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files (x86)\\Microsoft Office\\"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\PROGRA~2\\MICROS~2\\Office"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Windows\\System32\\msiexec.exe"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Windows\\SysWOW64\\msiexec.exe"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Windows\\System32\\regsvr32.exe"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Windows\\SysWOW64\\regsvr32.exe "
                                    ),
                                ]
                            ),
                            any(
                                [
                                    "\\Excel\\Addins\\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Excel\\Addins\\ExcelPlugInShell.PowerMapConnect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Excel\\Addins\\NativeShim\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Excel\\Addins\\NativeShim.InquireConnector.1\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Excel\\Addins\\PowerPivotExcelClientAddIn.NativeEntry.1\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\AddIns\\AccessAddin.DC\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\AddIns\\ColleagueImport.ColleagueImportAddin\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\AddIns\\EvernoteCC.EvernoteContactConnector\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\AddIns\\EvernoteOLRD.Connect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\OneNote.OutlookAddin"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\DriveFSExtensionLib.Connect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\GoogleAppsSync.Connect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\Microsoft.VbaAddinForOutlook.1\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\OcOffice.OcForms\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\OscAddin.Connect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\OutlookChangeNotifier.Connect\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\UCAddin.LyncAddin.1"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\UCAddin.UCAddin.1"
                                    in event.deep_get("TargetObject", default=""),
                                    "\\Outlook\\Addins\\UmOutlookAddin.FormRegionAddin\\"
                                    in event.deep_get("TargetObject", default=""),
                                    "AddinTakeNotesService\\FriendlyName"
                                    in event.deep_get("TargetObject", default=""),
                                ]
                            ),
                        ]
                    ),
                    all(
                        [
                            any(
                                [
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\"
                                    ),
                                ]
                            ),
                            event.deep_get("Image", default="").endswith("\\OfficeClickToRun.exe"),
                        ]
                    ),
                    all(
                        [
                            any(
                                [
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\"
                                    ),
                                    event.deep_get("Image", default="").startswith(
                                        "C:\\Program Files (x86)\\Microsoft Shared\\VSTO\\"
                                    ),
                                ]
                            ),
                            event.deep_get("Image", default="").endswith("\\VSTOInstaller.exe"),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    all(
                        [
                            event.deep_get("Image", default="")
                            in [
                                "C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe",
                                "C:\\Program Files\\AVG\\Antivirus\\x86\\RegSvr.exe",
                            ],
                            "\\Microsoft\\Office\\Outlook\\Addins\\Antivirus.AsOutExt\\"
                            in event.deep_get("TargetObject", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="")
                            in [
                                "C:\\Program Files\\Avast Software\\Avast\\RegSvr.exe",
                                "C:\\Program Files\\Avast Software\\Avast\\x86\\RegSvr.exe",
                            ],
                            "\\Microsoft\\Office\\Outlook\\Addins\\Avast.AsOutExt\\"
                            in event.deep_get("TargetObject", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
