def rule(event):
    if all(
        [
            any(
                [
                    "-m " in event.deep_get("CommandLine", default=""),
                    "-mode " in event.deep_get("CommandLine", default=""),
                    "-m:" in event.deep_get("CommandLine", default=""),
                    "-mode:" in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    "-i " in event.deep_get("CommandLine", default=""),
                    "-input " in event.deep_get("CommandLine", default=""),
                    "-i:" in event.deep_get("CommandLine", default=""),
                    "-input:" in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    "scan " in event.deep_get("CommandLine", default=""),
                    "scanall " in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    ":f " in event.deep_get("CommandLine", default=""),
                    ":r " in event.deep_get("CommandLine", default=""),
                    ":s " in event.deep_get("CommandLine", default=""),
                    " f " in event.deep_get("CommandLine", default=""),
                    " r " in event.deep_get("CommandLine", default=""),
                    " s " in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
