def rule(event):
    if all(
        [
            event.deep_get("Image", default="").endswith("/chmod"),
            any(
                [
                    "/tmp/" in event.deep_get("CommandLine", default=""),
                    "/.Library/" in event.deep_get("CommandLine", default=""),
                    "/etc/" in event.deep_get("CommandLine", default=""),
                    "/opt/" in event.deep_get("CommandLine", default=""),
                ]
            ),
            not any(
                [
                    all(
                        [
                            "chmod --reference=/etc/shells"
                            in event.deep_get("CommandLine", default=""),
                            event.deep_get("ParentCommandLine", default="").endswith(
                                "/update-shells"
                            ),
                        ]
                    ),
                    all(
                        [
                            "/etc/" in event.deep_get("CommandLine", default=""),
                            "/var/lib/dpkg/info/"
                            in event.deep_get("ParentCommandLine", default=""),
                            ".postinst configure"
                            in event.deep_get("ParentCommandLine", default=""),
                        ]
                    ),
                    event.deep_get("CommandLine", default="").startswith(
                        "chmod 700 /tmp/apt-key-gpghome."
                    ),
                    event.deep_get("CommandLine", default="").startswith(
                        "chmod 755 /var/tmp/mkinitramfs"
                    ),
                    event.deep_get("CommandLine", default="") == "chmod 0775 /etc/landscape/",
                    event.deep_get("CommandLine", default="")
                    == "chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu",
                ]
            ),
        ]
    ):
        return True
    return False
