def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") in [5038, 6281],
            not any(
                [
                    any(
                        [
                            "\\CSFalconServiceUninstallTool_"
                            in event.deep_get("param1", default=""),
                            "\\Program Files\\CrowdStrike\\"
                            in event.deep_get("param1", default=""),
                            "\\System32\\drivers\\CrowdStrike\\"
                            in event.deep_get("param1", default=""),
                            "\\Windows\\System32\\ScriptControl64_"
                            in event.deep_get("param1", default=""),
                        ]
                    ),
                    "\\Program Files\\Sophos\\" in event.deep_get("param1", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
