def rule(event):
    if all(
        [
            event.deep_get("Image", default="").endswith("\\3CXDesktopApp.exe"),
            any(
                [
                    "akamaicontainer.com" in event.deep_get("DestinationHostname", default=""),
                    "akamaitechcloudservices.com"
                    in event.deep_get("DestinationHostname", default=""),
                    "azuredeploystore.com" in event.deep_get("DestinationHostname", default=""),
                    "azureonlinecloud.com" in event.deep_get("DestinationHostname", default=""),
                    "azureonlinestorage.com" in event.deep_get("DestinationHostname", default=""),
                    "dunamistrd.com" in event.deep_get("DestinationHostname", default=""),
                    "glcloudservice.com" in event.deep_get("DestinationHostname", default=""),
                    "journalide.org" in event.deep_get("DestinationHostname", default=""),
                    "msedgepackageinfo.com" in event.deep_get("DestinationHostname", default=""),
                    "msstorageazure.com" in event.deep_get("DestinationHostname", default=""),
                    "msstorageboxes.com" in event.deep_get("DestinationHostname", default=""),
                    "officeaddons.com" in event.deep_get("DestinationHostname", default=""),
                    "officestoragebox.com" in event.deep_get("DestinationHostname", default=""),
                    "pbxcloudeservices.com" in event.deep_get("DestinationHostname", default=""),
                    "pbxphonenetwork.com" in event.deep_get("DestinationHostname", default=""),
                    "pbxsources.com" in event.deep_get("DestinationHostname", default=""),
                    "qwepoi123098.com" in event.deep_get("DestinationHostname", default=""),
                    "sbmsa.wiki" in event.deep_get("DestinationHostname", default=""),
                    "sourceslabs.com" in event.deep_get("DestinationHostname", default=""),
                    "visualstudiofactory.com" in event.deep_get("DestinationHostname", default=""),
                    "zacharryblogs.com" in event.deep_get("DestinationHostname", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
