def rule(event):
    if all(
        [
            ":\\Windows\\Microsoft.NET\\" in event.deep_get("Image", default=""),
            event.deep_get("Image", default="").endswith("\\dfsvc.exe"),
            event.deep_get("Initiated", default="") == "true",
            not event.deep_get("DestinationPort", default="") in [80, 443],
            not all(
                [
                    event.deep_get("DestinationIsIpv6", default="") == "true",
                    event.deep_get("DestinationPort", default="") == 53,
                ]
            ),
        ]
    ):
        return True
    return False
