def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("OriginalFileName", default="")
                    in [
                        "Excel.exe",
                        "MSACCESS.EXE",
                        "MSPUB.EXE",
                        "OneNote.exe",
                        "OneNoteM.exe",
                        "OUTLOOK.EXE",
                        "POWERPNT.EXE",
                        "WinWord.exe",
                        "Olk.exe",
                    ],
                    event.deep_get("Description", default="")
                    in [
                        "Microsoft Access",
                        "Microsoft Excel",
                        "Microsoft OneNote",
                        "Microsoft Outlook",
                        "Microsoft PowerPoint",
                        "Microsoft Publisher",
                        "Microsoft Word",
                        "Sent to OneNote Tool",
                    ],
                ]
            ),
            not any(
                [
                    event.deep_get("Image", default="").endswith("\\EXCEL.exe"),
                    event.deep_get("Image", default="").endswith("\\excelcnv.exe"),
                    event.deep_get("Image", default="").endswith("\\MSACCESS.exe"),
                    event.deep_get("Image", default="").endswith("\\MSPUB.EXE"),
                    event.deep_get("Image", default="").endswith("\\ONENOTE.EXE"),
                    event.deep_get("Image", default="").endswith("\\ONENOTEM.EXE"),
                    event.deep_get("Image", default="").endswith("\\OUTLOOK.EXE"),
                    event.deep_get("Image", default="").endswith("\\POWERPNT.EXE"),
                    event.deep_get("Image", default="").endswith("\\WINWORD.exe"),
                    event.deep_get("Image", default="").endswith("\\OLK.EXE"),
                ]
            ),
        ]
    ):
        return True
    return False
