def rule(event):
    if any(
        [
            event.deep_get("ParentImage", default="") == "C:\\Windows\\System32\\OpenSSH\\sshd.exe",
            all(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\ssh.exe"),
                            event.deep_get("Product", default="") == "OpenSSH for Windows",
                            any(
                                [
                                    "IMPHASH=55b4964d29aad5438b9e950052dbbbc0"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=334d66c33503ccbf647c15b47c27eef4"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=27b0da080ef92afb37983d30d839141e"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=977eb4c263d384e47daa0712d34713ab"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=3eaadce9ae43d5a918bb082065815c3b"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=980fe6cf0d996ab1eedf877222e722aa"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=5f959422308ac3d721010d66647e100e"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b"
                                    in event.deep_get("Hashes", default=""),
                                    "IMPHASH=dd335f759b6d5d6a8382b71dd9d65791"
                                    in event.deep_get("Hashes", default=""),
                                ]
                            ),
                        ]
                    ),
                    any(
                        [
                            "ProxyCommand=" in event.deep_get("CommandLine", default=""),
                            all(
                                [
                                    "PermitLocalCommand=yes"
                                    in event.deep_get("CommandLine", default=""),
                                    " LocalCommand" in event.deep_get("CommandLine", default=""),
                                ]
                            ),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
