def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith("\\iox.exe"),
            any(
                [
                    ".exe fwd -l " in event.deep_get("CommandLine", default=""),
                    ".exe fwd -r " in event.deep_get("CommandLine", default=""),
                    ".exe proxy -l " in event.deep_get("CommandLine", default=""),
                    ".exe proxy -r " in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    "MD5=9DB2D314DD3F704A02051EF5EA210993" in event.deep_get("Hashes", default=""),
                    "SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
