def rule(event):
    if all(
        [
            not any(
                [
                    "floppy" in event.deep_get("Device", default=""),
                    any(
                        [
                            event.deep_get("Image", default="").startswith("C:\\$WINDOWS.~BT\\"),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Program Files (x86)\\"
                            ),
                            event.deep_get("Image", default="").startswith("C:\\Program Files\\"),
                            event.deep_get("Image", default="").startswith("C:\\Windows\\CCM\\"),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\explorer.exe"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\servicing\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\SoftwareDistribution\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\System32\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\SystemApps\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\SysWOW64\\"
                            ),
                            event.deep_get("Image", default="").startswith("C:\\Windows\\uus\\"),
                            event.deep_get("Image", default="").startswith("C:\\Windows\\WinSxS\\"),
                        ]
                    ),
                    event.deep_get("Image", default="") in ["Registry", "System"],
                    all(
                        [
                            event.deep_get("Image", default="").startswith(
                                "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\"
                            ),
                            any(
                                [
                                    event.deep_get("Image", default="").endswith("\\MsMpEng.exe"),
                                    event.deep_get("Image", default="").endswith(
                                        "\\MpDefenderCoreService.exe"
                                    ),
                                ]
                            ),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="").startswith("C:\\Users\\"),
                            "\\AppData\\" in event.deep_get("Image", default=""),
                            "\\Microsoft\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="").startswith("C:\\Windows\\Temp\\"),
                            any(
                                [
                                    event.deep_get("Image", default="").endswith(
                                        "\\Executables\\SSDUpdate.exe"
                                    ),
                                    event.deep_get("Image", default="").endswith(
                                        "\\HostMetadata\\NVMEHostmetadata.exe"
                                    ),
                                ]
                            ),
                        ]
                    ),
                    event.deep_get("Image", default="") == "",
                    event.deep_get("Image", default="")
                    == "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
                    event.deep_get("Image", default="").startswith("C:\\$WinREAgent\\Scratch\\"),
                ]
            ),
            not any(
                [
                    all(
                        [
                            event.deep_get("Image", default="").startswith("C:\\Users\\"),
                            "\\AppData\\Local\\GitHubDesktop\\app-"
                            in event.deep_get("Image", default=""),
                            event.deep_get("Image", default="").endswith(
                                "\\resources\\app\\git\\mingw64\\bin\\git.exe"
                            ),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\Temp\\asgard2-agent\\"
                            ),
                            event.deep_get("Image", default="").endswith("\\thor.exe"),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="").startswith("C:\\Users\\"),
                            "\\AppData\\Local\\Keybase\\upd.exe"
                            in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
