def rule(event):
    if any(
        [
            any(
                [
                    "Add-ConstrainedDelegationBackdoor.ps1"
                    in event.deep_get("ContextInfo", default=""),
                    "Add-Exfiltration.ps1" in event.deep_get("ContextInfo", default=""),
                    "Add-Persistence.ps1" in event.deep_get("ContextInfo", default=""),
                    "Add-RegBackdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Add-RemoteRegBackdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Add-ScrnSaveBackdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "BadSuccessor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Check-VM.ps1" in event.deep_get("ContextInfo", default=""),
                    "ConvertTo-ROT13.ps1" in event.deep_get("ContextInfo", default=""),
                    "Copy-VSS.ps1" in event.deep_get("ContextInfo", default=""),
                    "Create-MultipleSessions.ps1" in event.deep_get("ContextInfo", default=""),
                    "DNS_TXT_Pwnage.ps1" in event.deep_get("ContextInfo", default=""),
                    "dnscat2.ps1" in event.deep_get("ContextInfo", default=""),
                    "Do-Exfiltration.ps1" in event.deep_get("ContextInfo", default=""),
                    "DomainPasswordSpray.ps1" in event.deep_get("ContextInfo", default=""),
                    "Download_Execute.ps1" in event.deep_get("ContextInfo", default=""),
                    "Download-Execute-PS.ps1" in event.deep_get("ContextInfo", default=""),
                    "Enabled-DuplicateToken.ps1" in event.deep_get("ContextInfo", default=""),
                    "Enable-DuplicateToken.ps1" in event.deep_get("ContextInfo", default=""),
                    "Execute-Command-MSSQL.ps1" in event.deep_get("ContextInfo", default=""),
                    "Execute-DNSTXT-Code.ps1" in event.deep_get("ContextInfo", default=""),
                    "Execute-OnTime.ps1" in event.deep_get("ContextInfo", default=""),
                    "ExetoText.ps1" in event.deep_get("ContextInfo", default=""),
                    "Exploit-Jboss.ps1" in event.deep_get("ContextInfo", default=""),
                    "Find-AVSignature.ps1" in event.deep_get("ContextInfo", default=""),
                    "Find-Fruit.ps1" in event.deep_get("ContextInfo", default=""),
                    "Find-GPOLocation.ps1" in event.deep_get("ContextInfo", default=""),
                    "Find-TrustedDocuments.ps1" in event.deep_get("ContextInfo", default=""),
                    "FireBuster.ps1" in event.deep_get("ContextInfo", default=""),
                    "FireListener.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ApplicationHost.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ChromeDump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ClipboardContents.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ComputerDetail.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-FoxDump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-GPPAutologon.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-GPPPassword.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-IndexedItem.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-Keystrokes.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-LSASecret.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-MicrophoneAudio.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-PassHashes.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-PassHints.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-RegAlwaysInstallElevated.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-RegAutoLogon.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-RickAstley.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-Screenshot.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-SecurityPackages.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ServiceFilePermission.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ServicePermission.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-ServiceUnquoted.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-SiteListPassword.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-System.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-TimedScreenshot.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-UnattendedInstallFile.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-Unconstrained.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-USBKeystrokes.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-VaultCredential.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-VulnAutoRun.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-VulnSchTask.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-WebConfig.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-WebCredentials.ps1" in event.deep_get("ContextInfo", default=""),
                    "Get-WLAN-Keys.ps1" in event.deep_get("ContextInfo", default=""),
                    "Gupt-Backdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "HTTP-Backdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "HTTP-Login.ps1" in event.deep_get("ContextInfo", default=""),
                    "Install-ServiceBinary.ps1" in event.deep_get("ContextInfo", default=""),
                    "Install-SSP.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ACLScanner.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ADSBackdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-AmsiBypass.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ARPScan.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-BackdoorLNK.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-BadPotato.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-BetterSafetyKatz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-BruteForce.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-BypassUAC.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Carbuncle.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Certify.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ConPtyShell.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-CredentialInjection.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-CredentialsPhish.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DAFT.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DCSync.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Decode.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DinvokeKatz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DllInjection.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DNSExfiltrator.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-DowngradeAccount.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-EgressCheck.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Encode.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-EventViewer.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Eyewitness.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-FakeLogonScreen.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Farmer.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Get-RBCD-Threaded.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Gopher.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Grouper2.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Grouper3.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-HandleKatz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Interceptor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Internalmonologue.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Inveigh.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-InveighRelay.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-JSRatRegsvr.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-JSRatRundll.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-KrbRelay.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-KrbRelayUp.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-LdapSignCheck.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Lockless.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-MalSCCM.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Mimikatz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-MimikatzWDigestDowngrade.ps1"
                    in event.deep_get("ContextInfo", default=""),
                    "Invoke-Mimikittenz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-MITM6.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-NanoDump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-NetRipper.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-NetworkRelay.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-NinjaCopy.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-OxidResolver.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-P0wnedshell.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-P0wnedshellx86.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Paranoia.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PortScan.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PoshRatHttp.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PoshRatHttps.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PostExfil.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerDump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerDPAPI.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellIcmp.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellTCP.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellTcpOneLine.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellTcpOneLineBind.ps1"
                    in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellUdp.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellUdpOneLine.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerShellWMI.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PowerThIEf.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PPLDump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Prasadhak.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PsExec.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PsGcat.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PsGcatAgent.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PSInject.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-PsUaCme.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ReflectivePEInjection.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ReverseDNSLookup.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Rubeus.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-RunAs.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SafetyKatz.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SauronEye.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SCShell.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Seatbelt.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ServiceAbuse.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SessionGopher.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ShellCode.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SMBScanner.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Snaffler.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Spoolsample.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SSHCommand.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-SSIDExfil.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-StandIn.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-StickyNotesExtract.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Tater.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Thunderfox.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-ThunderStruck.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-TokenManipulation.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Tokenvator.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-TotalExec.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-UrbanBishop.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-UserHunter.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-VoiceTroll.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Whisker.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-WinEnum.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-winPEAS.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-WireTap.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-WmiCommand.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-WScriptBypassUAC.ps1" in event.deep_get("ContextInfo", default=""),
                    "Invoke-Zerologon.ps1" in event.deep_get("ContextInfo", default=""),
                    "Keylogger.ps1" in event.deep_get("ContextInfo", default=""),
                    "MailRaider.ps1" in event.deep_get("ContextInfo", default=""),
                    "New-HoneyHash.ps1" in event.deep_get("ContextInfo", default=""),
                    "OfficeMemScraper.ps1" in event.deep_get("ContextInfo", default=""),
                    "Offline_Winpwn.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-CHM.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-DnsTxt.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-Excel.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-HTA.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-Java.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-JS.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-Minidump.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-RundllCommand.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-SCF.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-SCT.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-Shortcut.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-WebQuery.ps1" in event.deep_get("ContextInfo", default=""),
                    "Out-Word.ps1" in event.deep_get("ContextInfo", default=""),
                    "Parse_Keys.ps1" in event.deep_get("ContextInfo", default=""),
                    "Port-Scan.ps1" in event.deep_get("ContextInfo", default=""),
                    "PowerBreach.ps1" in event.deep_get("ContextInfo", default=""),
                    "powercat.ps1" in event.deep_get("ContextInfo", default=""),
                    "PowerRunAsSystem.psm1" in event.deep_get("ContextInfo", default=""),
                    "PowerSharpPack.ps1" in event.deep_get("ContextInfo", default=""),
                    "PowerUp.ps1" in event.deep_get("ContextInfo", default=""),
                    "PowerUpSQL.ps1" in event.deep_get("ContextInfo", default=""),
                    "PowerView.ps1" in event.deep_get("ContextInfo", default=""),
                    "PSAsyncShell.ps1" in event.deep_get("ContextInfo", default=""),
                    "RemoteHashRetrieval.ps1" in event.deep_get("ContextInfo", default=""),
                    "Remove-Persistence.ps1" in event.deep_get("ContextInfo", default=""),
                    "Remove-PoshRat.ps1" in event.deep_get("ContextInfo", default=""),
                    "Remove-Update.ps1" in event.deep_get("ContextInfo", default=""),
                    "Run-EXEonRemote.ps1" in event.deep_get("ContextInfo", default=""),
                    "Schtasks-Backdoor.ps1" in event.deep_get("ContextInfo", default=""),
                    "Set-DCShadowPermissions.ps1" in event.deep_get("ContextInfo", default=""),
                    "Set-MacAttribute.ps1" in event.deep_get("ContextInfo", default=""),
                    "Set-RemotePSRemoting.ps1" in event.deep_get("ContextInfo", default=""),
                    "Set-RemoteWMI.ps1" in event.deep_get("ContextInfo", default=""),
                    "Set-Wallpaper.ps1" in event.deep_get("ContextInfo", default=""),
                    "Show-TargetScreen.ps1" in event.deep_get("ContextInfo", default=""),
                    "Speak.ps1" in event.deep_get("ContextInfo", default=""),
                    "Start-CaptureServer.ps1" in event.deep_get("ContextInfo", default=""),
                    "Start-WebcamRecorder.ps1" in event.deep_get("ContextInfo", default=""),
                    "StringToBase64.ps1" in event.deep_get("ContextInfo", default=""),
                    "TexttoExe.ps1" in event.deep_get("ContextInfo", default=""),
                    "Veeam-Get-Creds.ps1" in event.deep_get("ContextInfo", default=""),
                    "VolumeShadowCopyTools.ps1" in event.deep_get("ContextInfo", default=""),
                    "WinPwn.ps1" in event.deep_get("ContextInfo", default=""),
                    "WSUSpendu.ps1" in event.deep_get("ContextInfo", default=""),
                ]
            ),
            all(
                [
                    "Invoke-Sharp" in event.deep_get("ContextInfo", default=""),
                    ".ps1" in event.deep_get("ContextInfo", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
