def rule(event):
    if all(
        [
            event.deep_get("ParentImage", default="").endswith("/TeamViewer_Service"),
            event.deep_get("Image", default="").endswith("/TeamViewer_Desktop"),
            event.deep_get("CommandLine", default="").endswith(
                "/TeamViewer_Desktop --IPCport 5939 --Module 1"
            ),
        ]
    ):
        return True
    return False
