import re


def rule(event):
    if all(
        [
            event.deep_get("EventID", default="") == 7045,
            any(
                [
                    re.match(
                        r"\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[",
                        event.deep_get("ImagePath", default=""),
                    ),
                    re.match(
                        r"\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[",
                        event.deep_get("ImagePath", default=""),
                    ),
                    re.match(
                        r"\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[",
                        event.deep_get("ImagePath", default=""),
                    ),
                    re.match(
                        r"\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}",
                        event.deep_get("ImagePath", default=""),
                    ),
                    re.match(
                        r"\\\\*mdr\\*\\W\\s*\\)\\.Name", event.deep_get("ImagePath", default="")
                    ),
                    re.match(
                        r"\\$VerbosePreference\\.ToString\\(",
                        event.deep_get("ImagePath", default=""),
                    ),
                    re.match(
                        r"\\String\\]\\s*\\$VerbosePreference",
                        event.deep_get("ImagePath", default=""),
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
