import json
import re


def rule(event):
    if all(
        [
            any(
                [
                    all(
                        [
                            event.deep_get("EventID", default="") == 5861,
                            any(
                                [
                                    "ActiveScriptEventConsumer" in json.dumps(event.to_dict()),
                                    "CommandLineEventConsumer" in json.dumps(event.to_dict()),
                                    "CommandLineTemplate" in json.dumps(event.to_dict()),
                                ]
                            ),
                        ]
                    ),
                    event.deep_get("EventID", default="") == 5859,
                ]
            ),
            not all(
                [
                    event.deep_get("Provider", default="") == "SCM Event Provider",
                    re.match(
                        r"^select .* from MSFT_SCMEventLogEvent$",
                        event.deep_get("Query", default=""),
                    ),
                    event.deep_get("User", default="") == "S-1-5-32-544",
                    event.deep_get("PossibleCause", default="") == "Permanent",
                ]
            ),
        ]
    ):
        return True
    return False
