def rule(event):
    if all(
        [
            any(
                [
                    "\\SOFTWARE\\Microsoft\\AMSI\\Providers\\"
                    in event.deep_get("TargetObject", default=""),
                    "\\SOFTWARE\\WOW6432Node\\Microsoft\\AMSI\\Providers\\"
                    in event.deep_get("TargetObject", default=""),
                ]
            ),
            not any(
                [
                    all(
                        [
                            event.deep_get("Image", default="")
                            in [
                                "C:\\Program Files\\Avast Software\\Avast\\RegSvr.exe",
                                "C:\\Program Files\\Avast Software\\Avast\\x86\\RegSvr.exe",
                            ],
                            "\\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}"
                            in event.deep_get("TargetObject", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="")
                            in [
                                "C:\\Program Files\\AVG\\Antivirus\\RegSvr.exe",
                                "C:\\Program Files\\AVG\\Antivirus\\x86\\RegSvr.exe",
                            ],
                            "\\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}"
                            in event.deep_get("TargetObject", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="")
                            == "C:\\Program Files\\Avira\\Endpoint Protection SDK\\endpointprotection.exe",
                            "\\{00000001-3DCC-4B48-A82E-E2071FE58E05}"
                            in event.deep_get("TargetObject", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
