def rule(event):
    if any(
        [
            "Backdoor.Cobalt" in event.deep_get("Signature", default=""),
            "Brutel" in event.deep_get("Signature", default=""),
            "BruteR" in event.deep_get("Signature", default=""),
            "CobaltStr" in event.deep_get("Signature", default=""),
            "CobaltStrike" in event.deep_get("Signature", default=""),
            "COBEACON" in event.deep_get("Signature", default=""),
            "Cometer" in event.deep_get("Signature", default=""),
            "Exploit.Script.CVE" in event.deep_get("Signature", default=""),
            "IISExchgSpawnCMD" in event.deep_get("Signature", default=""),
            "Metasploit" in event.deep_get("Signature", default=""),
            "Meterpreter" in event.deep_get("Signature", default=""),
            "MeteTool" in event.deep_get("Signature", default=""),
            "Mpreter" in event.deep_get("Signature", default=""),
            "MsfShell" in event.deep_get("Signature", default=""),
            "PowerSploit" in event.deep_get("Signature", default=""),
            "Razy" in event.deep_get("Signature", default=""),
            "Rozena" in event.deep_get("Signature", default=""),
            "Sbelt" in event.deep_get("Signature", default=""),
            "Seatbelt" in event.deep_get("Signature", default=""),
            "Sliver" in event.deep_get("Signature", default=""),
            "Swrort" in event.deep_get("Signature", default=""),
        ]
    ):
        return True
    return False
