def rule(event):
    if all(
        [
            any(
                [
                    ":\\$Recycle.bin" in event.deep_get("Image", default=""),
                    ":\\Perflogs\\" in event.deep_get("Image", default=""),
                    ":\\Temp\\" in event.deep_get("Image", default=""),
                    ":\\Users\\Default\\" in event.deep_get("Image", default=""),
                    ":\\Users\\Public\\" in event.deep_get("Image", default=""),
                    ":\\Windows\\Fonts\\" in event.deep_get("Image", default=""),
                    ":\\Windows\\IME\\" in event.deep_get("Image", default=""),
                    ":\\Windows\\System32\\Tasks\\" in event.deep_get("Image", default=""),
                    ":\\Windows\\Tasks\\" in event.deep_get("Image", default=""),
                    ":\\Windows\\Temp\\" in event.deep_get("Image", default=""),
                    "\\AppData\\Temp\\" in event.deep_get("Image", default=""),
                    "\\config\\systemprofile\\" in event.deep_get("Image", default=""),
                    "\\Windows\\addins\\" in event.deep_get("Image", default=""),
                ]
            ),
            event.deep_get("Initiated", default="") == "true",
            any(
                [
                    event.deep_get("DestinationHostname", default="").endswith(
                        ".githubusercontent.com"
                    ),
                    event.deep_get("DestinationHostname", default="").endswith("anonfiles.com"),
                    event.deep_get("DestinationHostname", default="").endswith(
                        "cdn.discordapp.com"
                    ),
                    event.deep_get("DestinationHostname", default="").endswith("ddns.net"),
                    event.deep_get("DestinationHostname", default="").endswith(
                        "dl.dropboxusercontent.com"
                    ),
                    event.deep_get("DestinationHostname", default="").endswith("ghostbin.co"),
                    event.deep_get("DestinationHostname", default="").endswith("github.com"),
                    event.deep_get("DestinationHostname", default="").endswith("glitch.me"),
                    event.deep_get("DestinationHostname", default="").endswith("gofile.io"),
                    event.deep_get("DestinationHostname", default="").endswith("hastebin.com"),
                    event.deep_get("DestinationHostname", default="").endswith("mediafire.com"),
                    event.deep_get("DestinationHostname", default="").endswith("mega.co.nz"),
                    event.deep_get("DestinationHostname", default="").endswith("mega.nz"),
                    event.deep_get("DestinationHostname", default="").endswith("onrender.com"),
                    event.deep_get("DestinationHostname", default="").endswith("pages.dev"),
                    event.deep_get("DestinationHostname", default="").endswith("paste.ee"),
                    event.deep_get("DestinationHostname", default="").endswith("pastebin.com"),
                    event.deep_get("DestinationHostname", default="").endswith("pastebin.pl"),
                    event.deep_get("DestinationHostname", default="").endswith("pastetext.net"),
                    event.deep_get("DestinationHostname", default="").endswith("pixeldrain.com"),
                    event.deep_get("DestinationHostname", default="").endswith("privatlab.com"),
                    event.deep_get("DestinationHostname", default="").endswith("privatlab.net"),
                    event.deep_get("DestinationHostname", default="").endswith("send.exploit.in"),
                    event.deep_get("DestinationHostname", default="").endswith("sendspace.com"),
                    event.deep_get("DestinationHostname", default="").endswith(
                        "storage.googleapis.com"
                    ),
                    event.deep_get("DestinationHostname", default="").endswith("storjshare.io"),
                    event.deep_get("DestinationHostname", default="").endswith("supabase.co"),
                    event.deep_get("DestinationHostname", default="").endswith("temp.sh"),
                    event.deep_get("DestinationHostname", default="").endswith("transfer.sh"),
                    event.deep_get("DestinationHostname", default="").endswith("trycloudflare.com"),
                    event.deep_get("DestinationHostname", default="").endswith("ufile.io"),
                    event.deep_get("DestinationHostname", default="").endswith("w3spaces.com"),
                    event.deep_get("DestinationHostname", default="").endswith("workers.dev"),
                ]
            ),
        ]
    ):
        return True
    return False
