import re


def rule(event):
    if any(
        [
            all(
                [
                    "Get-ItemProperty" in event.deep_get("ScriptBlockText", default=""),
                    "Registry::" in event.deep_get("ScriptBlockText", default=""),
                    "HKEY_CURRENT_USER\\Control Panel\\Desktop\\"
                    in event.deep_get("ScriptBlockText", default=""),
                    "WallPaper" in event.deep_get("ScriptBlockText", default=""),
                ]
            ),
            re.match(
                r"^.*SystemParametersInfo(20,0,.*,3).*$",
                event.deep_get("ScriptBlockText", default=""),
            ),
        ]
    ):
        return True
    return False
