def rule(event):
    if any(
        [
            all(
                [
                    "impersonate.exe" in event.deep_get("CommandLine", default=""),
                    any(
                        [
                            " list " in event.deep_get("CommandLine", default=""),
                            " exec " in event.deep_get("CommandLine", default=""),
                            " adduser " in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            any(
                [
                    "MD5=9520714AB576B0ED01D1513691377D01" in event.deep_get("Hashes", default=""),
                    "SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=0A358FFC1697B7A07D0E817AC740DF62"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
