def rule(event):
    if any(
        [
            all(
                [
                    any(
                        [
                            any(
                                [
                                    " -create " in event.deep_get("CommandLine", default=""),
                                    " /create " in event.deep_get("CommandLine", default=""),
                                    " –create " in event.deep_get("CommandLine", default=""),
                                    " —create " in event.deep_get("CommandLine", default=""),
                                    " ―create " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -delete " in event.deep_get("CommandLine", default=""),
                                    " /delete " in event.deep_get("CommandLine", default=""),
                                    " –delete " in event.deep_get("CommandLine", default=""),
                                    " —delete " in event.deep_get("CommandLine", default=""),
                                    " ―delete " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -query " in event.deep_get("CommandLine", default=""),
                                    " /query " in event.deep_get("CommandLine", default=""),
                                    " –query " in event.deep_get("CommandLine", default=""),
                                    " —query " in event.deep_get("CommandLine", default=""),
                                    " ―query " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -change " in event.deep_get("CommandLine", default=""),
                                    " /change " in event.deep_get("CommandLine", default=""),
                                    " –change " in event.deep_get("CommandLine", default=""),
                                    " —change " in event.deep_get("CommandLine", default=""),
                                    " ―change " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -run " in event.deep_get("CommandLine", default=""),
                                    " /run " in event.deep_get("CommandLine", default=""),
                                    " –run " in event.deep_get("CommandLine", default=""),
                                    " —run " in event.deep_get("CommandLine", default=""),
                                    " ―run " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -end " in event.deep_get("CommandLine", default=""),
                                    " /end " in event.deep_get("CommandLine", default=""),
                                    " –end " in event.deep_get("CommandLine", default=""),
                                    " —end " in event.deep_get("CommandLine", default=""),
                                    " ―end " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                        ]
                    ),
                    any(
                        [
                            any(
                                [
                                    " -tn " in event.deep_get("CommandLine", default=""),
                                    " /tn " in event.deep_get("CommandLine", default=""),
                                    " –tn " in event.deep_get("CommandLine", default=""),
                                    " —tn " in event.deep_get("CommandLine", default=""),
                                    " ―tn " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -tr " in event.deep_get("CommandLine", default=""),
                                    " /tr " in event.deep_get("CommandLine", default=""),
                                    " –tr " in event.deep_get("CommandLine", default=""),
                                    " —tr " in event.deep_get("CommandLine", default=""),
                                    " ―tr " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -sc " in event.deep_get("CommandLine", default=""),
                                    " /sc " in event.deep_get("CommandLine", default=""),
                                    " –sc " in event.deep_get("CommandLine", default=""),
                                    " —sc " in event.deep_get("CommandLine", default=""),
                                    " ―sc " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -st " in event.deep_get("CommandLine", default=""),
                                    " /st " in event.deep_get("CommandLine", default=""),
                                    " –st " in event.deep_get("CommandLine", default=""),
                                    " —st " in event.deep_get("CommandLine", default=""),
                                    " ―st " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -ru " in event.deep_get("CommandLine", default=""),
                                    " /ru " in event.deep_get("CommandLine", default=""),
                                    " –ru " in event.deep_get("CommandLine", default=""),
                                    " —ru " in event.deep_get("CommandLine", default=""),
                                    " ―ru " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                            any(
                                [
                                    " -fo " in event.deep_get("CommandLine", default=""),
                                    " /fo " in event.deep_get("CommandLine", default=""),
                                    " –fo " in event.deep_get("CommandLine", default=""),
                                    " —fo " in event.deep_get("CommandLine", default=""),
                                    " ―fo " in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                        ]
                    ),
                    not "schtasks" in event.deep_get("CommandLine", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("OriginalFileName", default="") == "schtasks.exe",
                    not event.deep_get("Image", default="").endswith("\\schtasks.exe"),
                ]
            ),
        ]
    ):
        return True
    return False
