def rule(event):
    if all(
        [
            event.deep_get("ParentImage", default="").endswith("/Script Editor"),
            any(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("/curl"),
                            event.deep_get("Image", default="").endswith("/bash"),
                            event.deep_get("Image", default="").endswith("/sh"),
                            event.deep_get("Image", default="").endswith("/zsh"),
                            event.deep_get("Image", default="").endswith("/dash"),
                            event.deep_get("Image", default="").endswith("/fish"),
                            event.deep_get("Image", default="").endswith("/osascript"),
                            event.deep_get("Image", default="").endswith("/mktemp"),
                            event.deep_get("Image", default="").endswith("/chmod"),
                            event.deep_get("Image", default="").endswith("/php"),
                            event.deep_get("Image", default="").endswith("/nohup"),
                            event.deep_get("Image", default="").endswith("/openssl"),
                            event.deep_get("Image", default="").endswith("/plutil"),
                            event.deep_get("Image", default="").endswith("/PlistBuddy"),
                            event.deep_get("Image", default="").endswith("/xattr"),
                            event.deep_get("Image", default="").endswith("/sqlite"),
                            event.deep_get("Image", default="").endswith("/funzip"),
                            event.deep_get("Image", default="").endswith("/popen"),
                        ]
                    ),
                    any(
                        [
                            "python" in event.deep_get("Image", default=""),
                            "perl" in event.deep_get("Image", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
