def rule(event):
    if any(
        [
            all(
                [
                    "--config " in event.deep_get("CommandLine", default=""),
                    "--no-check-certificate " in event.deep_get("CommandLine", default=""),
                    " copy " in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\rclone.exe"),
                            event.deep_get("Description", default="") == "Rsync for cloud storage",
                        ]
                    ),
                    any(
                        [
                            "pass" in event.deep_get("CommandLine", default=""),
                            "user" in event.deep_get("CommandLine", default=""),
                            "copy" in event.deep_get("CommandLine", default=""),
                            "sync" in event.deep_get("CommandLine", default=""),
                            "config" in event.deep_get("CommandLine", default=""),
                            "lsd" in event.deep_get("CommandLine", default=""),
                            "remote" in event.deep_get("CommandLine", default=""),
                            "ls" in event.deep_get("CommandLine", default=""),
                            "mega" in event.deep_get("CommandLine", default=""),
                            "pcloud" in event.deep_get("CommandLine", default=""),
                            "ftp" in event.deep_get("CommandLine", default=""),
                            "ignore-existing" in event.deep_get("CommandLine", default=""),
                            "auto-confirm" in event.deep_get("CommandLine", default=""),
                            "transfers" in event.deep_get("CommandLine", default=""),
                            "multi-thread-streams" in event.deep_get("CommandLine", default=""),
                            "no-check-certificate " in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
