def rule(event):
    if any(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\WCE.exe"),
                    event.deep_get("Image", default="").endswith("\\WCE64.exe"),
                ]
            ),
            any(
                [
                    "IMPHASH=136F0A8572C058A96436C82E541E4C41"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=589657C64DDE88533186C39F82FA1F50"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=7D490037BF450877E6D0287BDCFF8D2E"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=BA434A7A729EEC20E136CA4C32D6C740"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=E96A73C7BF33A464C510EDE582318BF2"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
