def rule(event):
    if any(
        [
            "WindowsAudioDevice-Powershell-Cmdlet" in event.deep_get("CommandLine", default=""),
            "Toggle-AudioDevice" in event.deep_get("CommandLine", default=""),
            "Get-AudioDevice " in event.deep_get("CommandLine", default=""),
            "Set-AudioDevice " in event.deep_get("CommandLine", default=""),
            "Write-AudioDevice " in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
