def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\wmic.exe"),
                    event.deep_get("OriginalFileName", default="") == "wmic.exe",
                    any(
                        [
                            "IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=37777A96245A3C74EB217308F3546F4C"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=B12619881D79C3ACADF45E752A58554A"
                            in event.deep_get("Hashes", default=""),
                            "IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00"
                            in event.deep_get("Hashes", default=""),
                        ]
                    ),
                ]
            ),
            any(
                [
                    "-format:" in event.deep_get("CommandLine", default=""),
                    "/format:" in event.deep_get("CommandLine", default=""),
                    "–format:" in event.deep_get("CommandLine", default=""),
                    "—format:" in event.deep_get("CommandLine", default=""),
                    "―format:" in event.deep_get("CommandLine", default=""),
                ]
            ),
            not any(
                [
                    any(
                        [
                            "Format:List" in event.deep_get("CommandLine", default=""),
                            "Format:htable" in event.deep_get("CommandLine", default=""),
                            "Format:hform" in event.deep_get("CommandLine", default=""),
                            "Format:table" in event.deep_get("CommandLine", default=""),
                            "Format:mof" in event.deep_get("CommandLine", default=""),
                            "Format:value" in event.deep_get("CommandLine", default=""),
                            "Format:rawxml" in event.deep_get("CommandLine", default=""),
                            "Format:xml" in event.deep_get("CommandLine", default=""),
                            "Format:csv" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "://" in event.deep_get("CommandLine", default=""),
                            "\\\\" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
