def rule(event):
    if all(
        [
            any(
                [
                    all(
                        [
                            "javascript:" in event.deep_get("CommandLine", default=""),
                            ".RegisterXLL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "url.dll" in event.deep_get("CommandLine", default=""),
                            "OpenURL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "url.dll" in event.deep_get("CommandLine", default=""),
                            "OpenURLA" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "url.dll" in event.deep_get("CommandLine", default=""),
                            "FileProtocolHandler" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "zipfldr.dll" in event.deep_get("CommandLine", default=""),
                            "RouteTheCall" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "shell32.dll" in event.deep_get("CommandLine", default=""),
                            "Control_RunDLL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "shell32.dll" in event.deep_get("CommandLine", default=""),
                            "ShellExec_RunDLL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "mshtml.dll" in event.deep_get("CommandLine", default=""),
                            "PrintHTML" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "advpack.dll" in event.deep_get("CommandLine", default=""),
                            "LaunchINFSection" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "advpack.dll" in event.deep_get("CommandLine", default=""),
                            "RegisterOCX" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "ieadvpack.dll" in event.deep_get("CommandLine", default=""),
                            "LaunchINFSection" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "ieadvpack.dll" in event.deep_get("CommandLine", default=""),
                            "RegisterOCX" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "ieframe.dll" in event.deep_get("CommandLine", default=""),
                            "OpenURL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "shdocvw.dll" in event.deep_get("CommandLine", default=""),
                            "OpenURL" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "syssetup.dll" in event.deep_get("CommandLine", default=""),
                            "SetupInfObjectInstallAction"
                            in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "setupapi.dll" in event.deep_get("CommandLine", default=""),
                            "InstallHinfSection" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "pcwutl.dll" in event.deep_get("CommandLine", default=""),
                            "LaunchApplication" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "dfshim.dll" in event.deep_get("CommandLine", default=""),
                            "ShOpenVerbApplication" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "dfshim.dll" in event.deep_get("CommandLine", default=""),
                            "ShOpenVerbShortcut" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "scrobj.dll" in event.deep_get("CommandLine", default=""),
                            "GenerateTypeLib" in event.deep_get("CommandLine", default=""),
                            "http" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "shimgvw.dll" in event.deep_get("CommandLine", default=""),
                            "ImageView_Fullscreen" in event.deep_get("CommandLine", default=""),
                            "http" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "comsvcs.dll" in event.deep_get("CommandLine", default=""),
                            "MiniDump" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    "shell32.dll,Control_RunDLL desk.cpl,screensaver,@screensaver"
                    in event.deep_get("CommandLine", default=""),
                    all(
                        [
                            event.deep_get("ParentImage", default="")
                            == "C:\\Windows\\System32\\control.exe",
                            ".cpl" in event.deep_get("ParentCommandLine", default=""),
                            "Shell32.dll" in event.deep_get("CommandLine", default=""),
                            "Control_RunDLL" in event.deep_get("CommandLine", default=""),
                            ".cpl" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("ParentImage", default="")
                            == "C:\\Windows\\System32\\control.exe",
                            event.deep_get("CommandLine", default="").startswith(
                                '"C:\\Windows\\system32\\rundll32.exe" Shell32.dll,Control_RunDLL "C:\\Windows\\System32\\'
                            ),
                            event.deep_get("CommandLine", default="").endswith('.cpl",'),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
