def rule(event):
    if any(
        [
            any(
                [
                    "MD5=f741f25ac909ee434e50812d436c73ff" in event.deep_get("Hashes", default=""),
                    "MD5=d40acbfc29ee24388262e3d8be16f622" in event.deep_get("Hashes", default=""),
                    "MD5=01bb2c16fadb992fa66228cd02d45c60" in event.deep_get("Hashes", default=""),
                    "MD5=9e1b18e62e42b5444fc55b51e640355b" in event.deep_get("Hashes", default=""),
                    "MD5=b7f8fe33ac471b074ca9e630ba0c7e79" in event.deep_get("Hashes", default=""),
                    "MD5=324579d717c9b9b8e71d0269d13f811f" in event.deep_get("Hashes", default=""),
                    "MD5=63257a1ddaf83cfa43fe24a3bc06c207" in event.deep_get("Hashes", default=""),
                    "MD5=049e85963826b059c9bac273bb9c82ab" in event.deep_get("Hashes", default=""),
                    "MD5=ecb98b7b4d4427eb8221381154ff4cb2" in event.deep_get("Hashes", default=""),
                    "MD5=faf87749ac790ec3a10dd069d10f9d63" in event.deep_get("Hashes", default=""),
                    "MD5=f296dba5d21ad18e6990b1992aea8f83" in event.deep_get("Hashes", default=""),
                    "MD5=93ba94355e794b6c6f98204cf39f7a11" in event.deep_get("Hashes", default=""),
                    "MD5=a258ef593ac63155523a461ecc73bdba" in event.deep_get("Hashes", default=""),
                    "MD5=97000eb5d1653f1140ee3f47186463c4" in event.deep_get("Hashes", default=""),
                    "MD5=95eb317fbbe14a82bd9fdf31c48b8d93" in event.deep_get("Hashes", default=""),
                    "MD5=32fe9f0d2630ac40ea29023920f20f49" in event.deep_get("Hashes", default=""),
                    "MD5=a05930dde939cfd02677fc18bb2b7df5" in event.deep_get("Hashes", default=""),
                    "MD5=124283924e86933ff9054a549d3a268b" in event.deep_get("Hashes", default=""),
                    "MD5=ceda6909b8573fdeb0351c6920225686" in event.deep_get("Hashes", default=""),
                    "MD5=60ce120040f2cd311c810ae6f6bbc182" in event.deep_get("Hashes", default=""),
                    "MD5=2f10cdc5b09100a260703a28eadd0ceb" in event.deep_get("Hashes", default=""),
                    "MD5=011d967028e797a4c16d547f7ba1463f" in event.deep_get("Hashes", default=""),
                    "MD5=2da9152c0970500c697c1c9b4a9e0360" in event.deep_get("Hashes", default=""),
                    "MD5=b5ba72034b8f44d431f55275bace9f8b" in event.deep_get("Hashes", default=""),
                    "MD5=d6ed9101df0f24e27ff92ddab42dacca" in event.deep_get("Hashes", default=""),
                    "MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d" in event.deep_get("Hashes", default=""),
                    "MD5=5e083cd0143ae95a6cb79b68c07ca573" in event.deep_get("Hashes", default=""),
                    "MD5=28caff93748cb84be70486e79f04c2df" in event.deep_get("Hashes", default=""),
                    "MD5=9d4f12c30f9b500f896efd1800e4dd11" in event.deep_get("Hashes", default=""),
                    "MD5=4586f7dd14271ad65a5fb696b393f4c0" in event.deep_get("Hashes", default=""),
                    "MD5=86ba9dddbdf49215145b5bcd081d4011" in event.deep_get("Hashes", default=""),
                    "MD5=9dce0a481343874ef9a36c9a825ef991" in event.deep_get("Hashes", default=""),
                    "MD5=85890f62e231ad964b1fda7a674747ec" in event.deep_get("Hashes", default=""),
                    "MD5=599be548da6441d7fe3e9a1bb8cb0833" in event.deep_get("Hashes", default=""),
                    "MD5=9b0c7fd5763f66e9b8c7b457fce53f96" in event.deep_get("Hashes", default=""),
                    "MD5=32d45718164205aec3e98e0223717d1d" in event.deep_get("Hashes", default=""),
                    "MD5=6ff5f373ee7f794cd17db50704d00ddb" in event.deep_get("Hashes", default=""),
                    "MD5=88efbdf41f0650f8f58a3053b0ca0459" in event.deep_get("Hashes", default=""),
                    "MD5=ef915f61f861d1fb7cbde9afd2e7bd93" in event.deep_get("Hashes", default=""),
                    "MD5=781fa16511a595757154b4304d2dd350" in event.deep_get("Hashes", default=""),
                    "MD5=5018ec39be0e296f4fc8c8575bfa8486" in event.deep_get("Hashes", default=""),
                    "MD5=f4a84d6f1caf0875b50135423d04139f" in event.deep_get("Hashes", default=""),
                    "SHA1=9c1431801fa6342ed68f047842b9a11778fc669b"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=c36c862f40dad78cb065197aad15fef690c262f2"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=bc8e23faea8b3c537f268b3e81d05b937012272d"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=12e0357658614ff60d480d1a6709be68a2e40c5f"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=18b33ab5719966393d424a3edbfa8dec225d98fa"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=f14c9633040897d375e3069fddc71e859f283778"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=08041b426c9f112ad2061bf3c8c718e34739d4fc"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=7be77c885d0c9a4af4cecc64d512987cf93ba937"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=72dbb719b05f89d9d2dbdf186714caf7639daa36"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=5b1498beb2cfb4d971e377801e7abce62c0e315b"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=292629c6ab33bddf123d26328025e2d157d9e8fc"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=be59e621e83a2d4c87b0e6c69a2d22f175408b11"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=0250ce9a716ab8cca1c70a9de4cbc49a51934995"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=607e1fa810c799735221a609af3bfc405728c02d"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=ab1c547f6d1c07a9e0a01e46adea3aae1cac12e3"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=044cf5698a8e6b0aeba5acb56567f06366a9a70a"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=ef2dea8c736d49607832986c6c2d6fdd68ba6491"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=efffc2bfb8af2e3242233db9a7109b903fc3f178"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=5a05d4320de9afbc84de8469dd02b3a109efb2d4"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=a785d88cf8b862a420b9be793ee6a9616aa94c84"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=5688d56cbaf0d934c4e37b112ba257e8fb63f4ea"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=5cd2ada1c26815fbfd6a0cd746d5d429c0d83a17"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=81d67b3d70c4e855cb11a453cc32997517708362"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=9cffce9de95e0109f4dfecce0ab2cb0a59cc58ad"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=09c6930d057f49c1c1e11cf9241fffc8c12df3a2"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=e27bf7db8d96db9d4c8a06ee5e9b8e9fcb86ac92"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=9e3c992415e390f9ada4d15c693b687f38a492d1"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=3f34a5ee303d37916584c888c4928e1c1164f92a"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=ea4c8c56a8f5c90a4c08366933e5fb2de611d0db"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=3150f14508ee4cae19cf09083499d1cda8426540"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=036ad9876fa552b1298c040e233d620ea44689c6"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=3a3c1dcb146bb4616904157344ce1a82cd173bf5"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=6230d6fca973fa26188dfbadede57afb4c15f75c"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=8f7b2a9b8842f339b1e33602b7f926ab65de1a4d"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=a586bb06b59a4736a47abff8423a54fe8e2c05c4"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=c82152cddf9e5df49094686531872ecd545976db"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=04c39ffc18533100aaa4f9c06baf2c719ac94a61"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=e082affa5cdb2d46452c6601a9e85acb8446b836"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=a075bfb6cf5c6451ce682197a87277c8bc188719"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=34c0c5839af1c92bce7562b91418443a2044c90d"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=74e10a9989e0ec8fe075537ac802bd3031ae7e08"
                    in event.deep_get("Hashes", default=""),
                    "SHA1=3a515551814775df0ccbe09f219bc972eae45a10"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=90fd5b855b5107e7abaaefb6e658f50d5d6e08ac28e35f31d8b03dcabf77872b"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=5836c24f233f77342fee825f3cad73caab7ab4fb65ec2aec309fd12bc1317e85"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=e850e54b12331249c357a20604281b9abf8a91e6f3d957463fc625e6b126ef03"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=9e752f29edcd0db9931c20b173eee8d4d8196f87382c68a6e7eb4c8a44d58795"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=7a8c127d6c41f80d178d2315ed2f751ac91b1cd54d008af13680e04f068f426f"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=9f65e1c142c4f814e056a197a2241fd09e09acf245c62897109871137321a72a"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=c9b52d03c66d54d6391c643b3559184b1425c84a372081ec2bfed07ebf6af275"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=1b96f6218498aa6baf6f6c15b8f99e542077e33feb1ab5472bbbf7d4de43eb6b"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=768021fc242054decc280675750dec0a9e74e764b8646864c58756fa2386d2a2"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=1e1b32bef31be040f0f038fcb5a2d68fb192daaef23c6167f91793d21e06ebae"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=606bd75ed9d2d6107ea7ee67063d1761a99f2fb5e932c8344d11395d24587dd6"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=b489d3cdd158f040322ae5c8d0139ad28eff743c738a10f2d0255c7e149bd92a"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=ca7ecf04a8ad63aff330492c15270d56760cb223a607cdb1431fb00e1b9985d1"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=9dc4fca72463078b70f6516559a179c78400b06534e63ee12fb38adbe2632559"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=c00d2aee59bac087d769e09b5b7f832176f7714fefdc6af2502e6031e3eb37c2"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=a8e96d564687064190eaf865774f773def05fdbf651aa5bbf66216c077b863ef"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=84ed328cee2a0505e87662faf6fc57915e3a831c97ee88ad691f5c63522e139d"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=c143de99c57965d3a44c1fce6a97c2773b050609c1ea7f45688a4ca2422a5524"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=01d1efd5e552c59baa70c0778902233c05fde7de6e5cc156c62607df0804d36b"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=9a8dfeb7e3174f3510691e2b32d0f9088e0ed67d9ed1b2afbe450d70dec2016b"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=63b92a114075d855f706979d50ed3460fe39f8a2f5498b7657f0d14865117629"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=2eb014130ff837b6481c26f0d0152f84de22ca7370b15a4f51921e0054a2a358"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=7d5bb4271bf8ca2b63a59e731f3ec831dbda53adb8e28665e956afb4941f32ca"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=e57098a75bf32e127c214b61bfba492d6b209e211f065fcc84ff10637a2143ea"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=dd14dbcdbcfcf4bc108a926b9667af4944a3b6faf808cf1bb9a3a2554722e172"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=dca2b1b824cb28bd15577eace45bde7ff8f8f44705b17085524659de31761de4"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=8b95f339a07d59a8c8d8580283dffb9e8dfabdeb9171e42c948ab68c71afe7f2"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=5428a840fab6ac4a0ecb2fc20dbc5f928432b00b9297dd1cb6e69336f44eba66"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=e2517ae0fccaa4aefe039026a4fc855964f0c2a5f84177140200b0e58ddbfd27"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=75d05880de2593480254181215dd9a0075373876f2f4a2a4a9a654b2e0729a41"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=56490e14ce3817c3a1ddc0d97b96e90d6351bcd29914e7c9282f6a998cca84b1"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=f25d0a5e77e4ed9e7c4204a33cfc8e46281b43adbee550b15701dd00f41bdbe0"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=845a5fdcbb08e7efa7e0eabfcd881c9eebc0eec0a3a2f8689194e6b91b6eeaf8"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=9a89e6652e563d26a3f328ba23d91f464c9549da734557c5a02559df24b2700d"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=5614f2bc9b2ed414aab2c5c7997bdcbe8236e67ced8f91a63d1b6cfbe6e08726"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=37bf92dcedb47a90d8d38ebda8d8dd168ef5803dcb01161f8cf6d68b70d49d90"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=ec8590f91f5cc21e931c57345425f0625a6e37dfba026b222260450de40459f5"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=3994eb72b1c227c593e14b8cad7001de11d1c247d4fbf84d0714bb8a17853140"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=d654f870436d63c9d8e4390d9d4d898abdf0456736c7654d71cdf81a299c3f87"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=63fbfabd4d8afb497dee47d112eb9d683671b75a8bf6407c4bd5027fd211b892"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=47028053f05188e6a366fff19bedbcad2bc4daba8ff9e4df724b77d0181b7054"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=7c1b1e8c880a30c43b3a52ee245f963a977e1f40284f4b83f4b9afe3821753dd"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
            event.deep_get("Image", default="").endswith("\\PingCastle.exe"),
            event.deep_get("OriginalFileName", default="") == "PingCastle.exe",
            event.deep_get("Product", default="") == "Ping Castle",
            any(
                [
                    "--scanner aclcheck" in event.deep_get("CommandLine", default=""),
                    "--scanner antivirus" in event.deep_get("CommandLine", default=""),
                    "--scanner computerversion" in event.deep_get("CommandLine", default=""),
                    "--scanner foreignusers" in event.deep_get("CommandLine", default=""),
                    "--scanner laps_bitlocker" in event.deep_get("CommandLine", default=""),
                    "--scanner localadmin" in event.deep_get("CommandLine", default=""),
                    "--scanner nullsession" in event.deep_get("CommandLine", default=""),
                    "--scanner nullsession-trust" in event.deep_get("CommandLine", default=""),
                    "--scanner oxidbindings" in event.deep_get("CommandLine", default=""),
                    "--scanner remote" in event.deep_get("CommandLine", default=""),
                    "--scanner share" in event.deep_get("CommandLine", default=""),
                    "--scanner smb" in event.deep_get("CommandLine", default=""),
                    "--scanner smb3querynetwork" in event.deep_get("CommandLine", default=""),
                    "--scanner spooler" in event.deep_get("CommandLine", default=""),
                    "--scanner startup" in event.deep_get("CommandLine", default=""),
                    "--scanner zerologon" in event.deep_get("CommandLine", default=""),
                ]
            ),
            "--no-enum-limit" in event.deep_get("CommandLine", default=""),
            all(
                [
                    "--healthcheck" in event.deep_get("CommandLine", default=""),
                    "--level Full" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    "--healthcheck" in event.deep_get("CommandLine", default=""),
                    "--server " in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
