def rule(event):
    if all(
        [
            event.deep_get("TargetObject", default="").endswith(
                "\\Microsoft\\Internet Explorer\\Main\\DisableFirstRunCustomize"
            ),
            event.deep_get("Details", default="") in ["DWORD (0x00000001)", "DWORD (0x00000002)"],
            not event.deep_get("Image", default="")
            in ["C:\\Windows\\explorer.exe", "C:\\Windows\\System32\\ie4uinit.exe"],
            not any(
                [
                    all(
                        [
                            "\\Temp\\" in event.deep_get("Image", default=""),
                            "\\.cr\\avira_" in event.deep_get("Image", default=""),
                            "DWORD (0x00000001)" in event.deep_get("Details", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="")
                            in [
                                "C:\\Program Files (x86)\\Foxit Software\\Foxit PDF Reader\\FoxitPDFReader.exe",
                                "C:\\Program Files\\Foxit Software\\Foxit PDF Reader\\FoxitPDFReader.exe",
                            ],
                            "DWORD (0x00000001)" in event.deep_get("Details", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
