def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\chrome.exe"),
                            event.deep_get("Image", default="").endswith("\\code.exe"),
                            event.deep_get("Image", default="").endswith("\\discord.exe"),
                            event.deep_get("Image", default="").endswith("\\GitHubDesktop.exe"),
                            event.deep_get("Image", default="").endswith("\\keybase.exe"),
                            event.deep_get("Image", default="").endswith("\\msedge_proxy.exe"),
                            event.deep_get("Image", default="").endswith("\\msedge.exe"),
                            event.deep_get("Image", default="").endswith("\\msedgewebview2.exe"),
                            event.deep_get("Image", default="").endswith("\\msteams.exe"),
                            event.deep_get("Image", default="").endswith("\\slack.exe"),
                            event.deep_get("Image", default="").endswith("\\Teams.exe"),
                        ]
                    ),
                    event.deep_get("OriginalFileName", default="")
                    in [
                        "chrome.exe",
                        "code.exe",
                        "discord.exe",
                        "GitHubDesktop.exe",
                        "keybase.exe",
                        "msedge_proxy.exe",
                        "msedge.exe",
                        "msedgewebview2.exe",
                        "msteams.exe",
                        "slack.exe",
                        "Teams.exe",
                    ],
                ]
            ),
            any(
                [
                    "--browser-subprocess-path" in event.deep_get("CommandLine", default=""),
                    "--gpu-launcher" in event.deep_get("CommandLine", default=""),
                    "--renderer-cmd-prefix" in event.deep_get("CommandLine", default=""),
                    "--utility-cmd-prefix" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
