def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\AtBroker.exe"),
                    event.deep_get("OriginalFileName", default="") == "AtBroker.exe",
                ]
            ),
            "start" in event.deep_get("CommandLine", default=""),
            not any(
                [
                    "animations" in event.deep_get("CommandLine", default=""),
                    "audiodescription" in event.deep_get("CommandLine", default=""),
                    "caretbrowsing" in event.deep_get("CommandLine", default=""),
                    "caretwidth" in event.deep_get("CommandLine", default=""),
                    "colorfiltering" in event.deep_get("CommandLine", default=""),
                    "cursorindicator" in event.deep_get("CommandLine", default=""),
                    "cursorscheme" in event.deep_get("CommandLine", default=""),
                    "filterkeys" in event.deep_get("CommandLine", default=""),
                    "focusborderheight" in event.deep_get("CommandLine", default=""),
                    "focusborderwidth" in event.deep_get("CommandLine", default=""),
                    "highcontrast" in event.deep_get("CommandLine", default=""),
                    "keyboardcues" in event.deep_get("CommandLine", default=""),
                    "keyboardpref" in event.deep_get("CommandLine", default=""),
                    "livecaptions" in event.deep_get("CommandLine", default=""),
                    "magnifierpane" in event.deep_get("CommandLine", default=""),
                    "messageduration" in event.deep_get("CommandLine", default=""),
                    "minimumhitradius" in event.deep_get("CommandLine", default=""),
                    "mousekeys" in event.deep_get("CommandLine", default=""),
                    "Narrator" in event.deep_get("CommandLine", default=""),
                    "osk" in event.deep_get("CommandLine", default=""),
                    "overlappedcontent" in event.deep_get("CommandLine", default=""),
                    "showsounds" in event.deep_get("CommandLine", default=""),
                    "soundsentry" in event.deep_get("CommandLine", default=""),
                    "speechreco" in event.deep_get("CommandLine", default=""),
                    "stickykeys" in event.deep_get("CommandLine", default=""),
                    "togglekeys" in event.deep_get("CommandLine", default=""),
                    "voiceaccess" in event.deep_get("CommandLine", default=""),
                    "windowarranging" in event.deep_get("CommandLine", default=""),
                    "windowtracking" in event.deep_get("CommandLine", default=""),
                    "windowtrackingtimeout" in event.deep_get("CommandLine", default=""),
                    "windowtrackingzorder" in event.deep_get("CommandLine", default=""),
                ]
            ),
            not "Oracle_JavaAccessBridge" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
