def rule(event):
    if all(
        [
            event.deep_get("ParentImage", default="").endswith("\\DllHost.exe"),
            any(
                [
                    " /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"
                    in event.deep_get("ParentCommandLine", default=""),
                    " /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}"
                    in event.deep_get("ParentCommandLine", default=""),
                    " /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
                    in event.deep_get("ParentCommandLine", default=""),
                    " /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}"
                    in event.deep_get("ParentCommandLine", default=""),
                    " /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}"
                    in event.deep_get("ParentCommandLine", default=""),
                ]
            ),
            event.deep_get("IntegrityLevel", default="")
            in ["High", "System", "S-1-16-16384", "S-1-16-12288"],
        ]
    ):
        return True
    return False
