def rule(event):
    if all(
        [
            "HostApplication=" in event.deep_get("Data", default=""),
            not any(
                [
                    "HostApplication=?:/Windows/System32/WindowsPowerShell/v1.0/powershell"
                    in event.deep_get("Data", default=""),
                    "HostApplication=?:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell"
                    in event.deep_get("Data", default=""),
                    "HostApplication=?:\\Windows\\System32\\sdiagnhost.exe"
                    in event.deep_get("Data", default=""),
                    "HostApplication=?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell"
                    in event.deep_get("Data", default=""),
                    "HostApplication=?:\\Windows\\SysWOW64\\sdiagnhost.exe"
                    in event.deep_get("Data", default=""),
                    "HostApplication=?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell"
                    in event.deep_get("Data", default=""),
                    "HostApplication=powershell" in event.deep_get("Data", default=""),
                ]
            ),
            not any(
                [
                    "Citrix\\ConfigSync\\ConfigSync.ps1" in event.deep_get("Data", default=""),
                    "HostApplication=C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe"
                    in event.deep_get("Data", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
