def rule(event):
    if any(
        [
            any(
                [
                    event.deep_get("ParentImage", default="").endswith(".doc.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".docx.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".xls.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".xlsx.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".ppt.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".pptx.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".rtf.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".pdf.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".txt.lnk"),
                    event.deep_get("ParentImage", default="").endswith(".doc.js"),
                    event.deep_get("ParentImage", default="").endswith(".docx.js"),
                    event.deep_get("ParentImage", default="").endswith(".xls.js"),
                    event.deep_get("ParentImage", default="").endswith(".xlsx.js"),
                    event.deep_get("ParentImage", default="").endswith(".ppt.js"),
                    event.deep_get("ParentImage", default="").endswith(".pptx.js"),
                    event.deep_get("ParentImage", default="").endswith(".rtf.js"),
                    event.deep_get("ParentImage", default="").endswith(".pdf.js"),
                    event.deep_get("ParentImage", default="").endswith(".txt.js"),
                ]
            ),
            any(
                [
                    ".doc.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".docx.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".xls.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".xlsx.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".ppt.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".pptx.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".rtf.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".pdf.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".txt.lnk" in event.deep_get("ParentCommandLine", default=""),
                    ".doc.js" in event.deep_get("ParentCommandLine", default=""),
                    ".docx.js" in event.deep_get("ParentCommandLine", default=""),
                    ".xls.js" in event.deep_get("ParentCommandLine", default=""),
                    ".xlsx.js" in event.deep_get("ParentCommandLine", default=""),
                    ".ppt.js" in event.deep_get("ParentCommandLine", default=""),
                    ".pptx.js" in event.deep_get("ParentCommandLine", default=""),
                    ".rtf.js" in event.deep_get("ParentCommandLine", default=""),
                    ".pdf.js" in event.deep_get("ParentCommandLine", default=""),
                    ".txt.js" in event.deep_get("ParentCommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
