def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\dotnet.exe"),
                    event.deep_get("OriginalFileName", default="") == ".NET Host",
                ]
            ),
            any(
                [
                    event.deep_get("CommandLine", default="").endswith(".csproj"),
                    event.deep_get("CommandLine", default="").endswith('.csproj"'),
                    event.deep_get("CommandLine", default="").endswith(".dll"),
                    event.deep_get("CommandLine", default="").endswith('.dll"'),
                    event.deep_get("CommandLine", default="").endswith(".csproj'"),
                    event.deep_get("CommandLine", default="").endswith(".dll'"),
                ]
            ),
            not all(
                [
                    event.deep_get("ParentImage", default="")
                    in [
                        "C:\\Program Files (x86)\\Notepad++\\notepad++.exe",
                        "C:\\Program Files\\Notepad++\\notepad++.exe",
                    ],
                    "C:\\ProgramData\\CSScriptNpp\\" in event.deep_get("CommandLine", default=""),
                    "-cscs_path:" in event.deep_get("CommandLine", default=""),
                    "\\cs-script\\cscs.dll" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
