def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("TargetObject", default="").endswith(
                        "CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\InprocServer32\\(Default)"
                    ),
                    event.deep_get("TargetObject", default="").endswith(
                        "CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\InProcServer32\\(Default)"
                    ),
                ]
            ),
            not any(
                [
                    event.deep_get("Details", default="").endswith("system32\\wbem\\wmiutils.dll"),
                    event.deep_get("Details", default="").endswith("system32\\wbem\\wbemsvc.dll"),
                ]
            ),
        ]
    ):
        return True
    return False
