def rule(event):
    if all(
        [
            event.deep_get("TargetObject", default="").endswith(
                "_Classes\\mscfile\\shell\\open\\command\\(Default)"
            ),
            not event.deep_get("Details", default="").startswith(
                '%SystemRoot%\\system32\\mmc.exe "%1" %'
            ),
        ]
    ):
        return True
    return False
