def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\net.exe"),
                            event.deep_get("Image", default="").endswith("\\net1.exe"),
                        ]
                    ),
                    event.deep_get("OriginalFileName", default="") in ["net.exe", "net1.exe"],
                ]
            ),
            " user " in event.deep_get("CommandLine", default=""),
            any(
                [
                    " Järjestelmänvalvoja " in event.deep_get("CommandLine", default=""),
                    " Rendszergazda " in event.deep_get("CommandLine", default=""),
                    " Администратор " in event.deep_get("CommandLine", default=""),
                    " Administrateur " in event.deep_get("CommandLine", default=""),
                    " Administrador " in event.deep_get("CommandLine", default=""),
                    " Administratör " in event.deep_get("CommandLine", default=""),
                    " Administrator " in event.deep_get("CommandLine", default=""),
                    " guest " in event.deep_get("CommandLine", default=""),
                    " DefaultAccount " in event.deep_get("CommandLine", default=""),
                    ' "Järjestelmänvalvoja" ' in event.deep_get("CommandLine", default=""),
                    ' "Rendszergazda" ' in event.deep_get("CommandLine", default=""),
                    ' "Администратор" ' in event.deep_get("CommandLine", default=""),
                    ' "Administrateur" ' in event.deep_get("CommandLine", default=""),
                    ' "Administrador" ' in event.deep_get("CommandLine", default=""),
                    ' "Administratör" ' in event.deep_get("CommandLine", default=""),
                    ' "Administrator" ' in event.deep_get("CommandLine", default=""),
                    ' "guest" ' in event.deep_get("CommandLine", default=""),
                    ' "DefaultAccount" ' in event.deep_get("CommandLine", default=""),
                    " 'Järjestelmänvalvoja' " in event.deep_get("CommandLine", default=""),
                    " 'Rendszergazda' " in event.deep_get("CommandLine", default=""),
                    " 'Администратор' " in event.deep_get("CommandLine", default=""),
                    " 'Administrateur' " in event.deep_get("CommandLine", default=""),
                    " 'Administrador' " in event.deep_get("CommandLine", default=""),
                    " 'Administratör' " in event.deep_get("CommandLine", default=""),
                    " 'Administrator' " in event.deep_get("CommandLine", default=""),
                    " 'guest' " in event.deep_get("CommandLine", default=""),
                    " 'DefaultAccount' " in event.deep_get("CommandLine", default=""),
                ]
            ),
            not all(
                [
                    "guest" in event.deep_get("CommandLine", default=""),
                    "/active no" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
