def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Description", default="") == "PAExec Application",
                    event.deep_get("OriginalFileName", default="") == "PAExec.exe",
                    "PAExec" in event.deep_get("Product", default=""),
                    any(
                        [
                            "IMPHASH=11D40A7B7876288F919AB819CC2D9802"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=6444f8a34e99b8f7d9647de66aabe516"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=1a6cca4d5460b1710a12dea39e4a592c"
                            in event.deep_get("Hashes", default=""),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    event.deep_get("Image", default="").endswith("\\paexec.exe"),
                    event.deep_get("Image", default="").startswith("C:\\Windows\\PAExec-"),
                ]
            ),
        ]
    ):
        return True
    return False
