def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            " -s cmd" in event.deep_get("CommandLine", default=""),
                            " /s cmd" in event.deep_get("CommandLine", default=""),
                            " –s cmd" in event.deep_get("CommandLine", default=""),
                            " —s cmd" in event.deep_get("CommandLine", default=""),
                            " ―s cmd" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -s -i cmd" in event.deep_get("CommandLine", default=""),
                            " -s /i cmd" in event.deep_get("CommandLine", default=""),
                            " -s –i cmd" in event.deep_get("CommandLine", default=""),
                            " -s —i cmd" in event.deep_get("CommandLine", default=""),
                            " -s ―i cmd" in event.deep_get("CommandLine", default=""),
                            " /s -i cmd" in event.deep_get("CommandLine", default=""),
                            " /s /i cmd" in event.deep_get("CommandLine", default=""),
                            " /s –i cmd" in event.deep_get("CommandLine", default=""),
                            " /s —i cmd" in event.deep_get("CommandLine", default=""),
                            " /s ―i cmd" in event.deep_get("CommandLine", default=""),
                            " –s -i cmd" in event.deep_get("CommandLine", default=""),
                            " –s /i cmd" in event.deep_get("CommandLine", default=""),
                            " –s –i cmd" in event.deep_get("CommandLine", default=""),
                            " –s —i cmd" in event.deep_get("CommandLine", default=""),
                            " –s ―i cmd" in event.deep_get("CommandLine", default=""),
                            " —s -i cmd" in event.deep_get("CommandLine", default=""),
                            " —s /i cmd" in event.deep_get("CommandLine", default=""),
                            " —s –i cmd" in event.deep_get("CommandLine", default=""),
                            " —s —i cmd" in event.deep_get("CommandLine", default=""),
                            " —s ―i cmd" in event.deep_get("CommandLine", default=""),
                            " ―s -i cmd" in event.deep_get("CommandLine", default=""),
                            " ―s /i cmd" in event.deep_get("CommandLine", default=""),
                            " ―s –i cmd" in event.deep_get("CommandLine", default=""),
                            " ―s —i cmd" in event.deep_get("CommandLine", default=""),
                            " ―s ―i cmd" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -i -s cmd" in event.deep_get("CommandLine", default=""),
                            " -i /s cmd" in event.deep_get("CommandLine", default=""),
                            " -i –s cmd" in event.deep_get("CommandLine", default=""),
                            " -i —s cmd" in event.deep_get("CommandLine", default=""),
                            " -i ―s cmd" in event.deep_get("CommandLine", default=""),
                            " /i -s cmd" in event.deep_get("CommandLine", default=""),
                            " /i /s cmd" in event.deep_get("CommandLine", default=""),
                            " /i –s cmd" in event.deep_get("CommandLine", default=""),
                            " /i —s cmd" in event.deep_get("CommandLine", default=""),
                            " /i ―s cmd" in event.deep_get("CommandLine", default=""),
                            " –i -s cmd" in event.deep_get("CommandLine", default=""),
                            " –i /s cmd" in event.deep_get("CommandLine", default=""),
                            " –i –s cmd" in event.deep_get("CommandLine", default=""),
                            " –i —s cmd" in event.deep_get("CommandLine", default=""),
                            " –i ―s cmd" in event.deep_get("CommandLine", default=""),
                            " —i -s cmd" in event.deep_get("CommandLine", default=""),
                            " —i /s cmd" in event.deep_get("CommandLine", default=""),
                            " —i –s cmd" in event.deep_get("CommandLine", default=""),
                            " —i —s cmd" in event.deep_get("CommandLine", default=""),
                            " —i ―s cmd" in event.deep_get("CommandLine", default=""),
                            " ―i -s cmd" in event.deep_get("CommandLine", default=""),
                            " ―i /s cmd" in event.deep_get("CommandLine", default=""),
                            " ―i –s cmd" in event.deep_get("CommandLine", default=""),
                            " ―i —s cmd" in event.deep_get("CommandLine", default=""),
                            " ―i ―s cmd" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -s pwsh" in event.deep_get("CommandLine", default=""),
                            " /s pwsh" in event.deep_get("CommandLine", default=""),
                            " –s pwsh" in event.deep_get("CommandLine", default=""),
                            " —s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s pwsh" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -s -i pwsh" in event.deep_get("CommandLine", default=""),
                            " -s /i pwsh" in event.deep_get("CommandLine", default=""),
                            " -s –i pwsh" in event.deep_get("CommandLine", default=""),
                            " -s —i pwsh" in event.deep_get("CommandLine", default=""),
                            " -s ―i pwsh" in event.deep_get("CommandLine", default=""),
                            " /s -i pwsh" in event.deep_get("CommandLine", default=""),
                            " /s /i pwsh" in event.deep_get("CommandLine", default=""),
                            " /s –i pwsh" in event.deep_get("CommandLine", default=""),
                            " /s —i pwsh" in event.deep_get("CommandLine", default=""),
                            " /s ―i pwsh" in event.deep_get("CommandLine", default=""),
                            " –s -i pwsh" in event.deep_get("CommandLine", default=""),
                            " –s /i pwsh" in event.deep_get("CommandLine", default=""),
                            " –s –i pwsh" in event.deep_get("CommandLine", default=""),
                            " –s —i pwsh" in event.deep_get("CommandLine", default=""),
                            " –s ―i pwsh" in event.deep_get("CommandLine", default=""),
                            " —s -i pwsh" in event.deep_get("CommandLine", default=""),
                            " —s /i pwsh" in event.deep_get("CommandLine", default=""),
                            " —s –i pwsh" in event.deep_get("CommandLine", default=""),
                            " —s —i pwsh" in event.deep_get("CommandLine", default=""),
                            " —s ―i pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s -i pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s /i pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s –i pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s —i pwsh" in event.deep_get("CommandLine", default=""),
                            " ―s ―i pwsh" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -i -s pwsh" in event.deep_get("CommandLine", default=""),
                            " -i /s pwsh" in event.deep_get("CommandLine", default=""),
                            " -i –s pwsh" in event.deep_get("CommandLine", default=""),
                            " -i —s pwsh" in event.deep_get("CommandLine", default=""),
                            " -i ―s pwsh" in event.deep_get("CommandLine", default=""),
                            " /i -s pwsh" in event.deep_get("CommandLine", default=""),
                            " /i /s pwsh" in event.deep_get("CommandLine", default=""),
                            " /i –s pwsh" in event.deep_get("CommandLine", default=""),
                            " /i —s pwsh" in event.deep_get("CommandLine", default=""),
                            " /i ―s pwsh" in event.deep_get("CommandLine", default=""),
                            " –i -s pwsh" in event.deep_get("CommandLine", default=""),
                            " –i /s pwsh" in event.deep_get("CommandLine", default=""),
                            " –i –s pwsh" in event.deep_get("CommandLine", default=""),
                            " –i —s pwsh" in event.deep_get("CommandLine", default=""),
                            " –i ―s pwsh" in event.deep_get("CommandLine", default=""),
                            " —i -s pwsh" in event.deep_get("CommandLine", default=""),
                            " —i /s pwsh" in event.deep_get("CommandLine", default=""),
                            " —i –s pwsh" in event.deep_get("CommandLine", default=""),
                            " —i —s pwsh" in event.deep_get("CommandLine", default=""),
                            " —i ―s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―i -s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―i /s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―i –s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―i —s pwsh" in event.deep_get("CommandLine", default=""),
                            " ―i ―s pwsh" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -s powershell" in event.deep_get("CommandLine", default=""),
                            " /s powershell" in event.deep_get("CommandLine", default=""),
                            " –s powershell" in event.deep_get("CommandLine", default=""),
                            " —s powershell" in event.deep_get("CommandLine", default=""),
                            " ―s powershell" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -s -i powershell" in event.deep_get("CommandLine", default=""),
                            " -s /i powershell" in event.deep_get("CommandLine", default=""),
                            " -s –i powershell" in event.deep_get("CommandLine", default=""),
                            " -s —i powershell" in event.deep_get("CommandLine", default=""),
                            " -s ―i powershell" in event.deep_get("CommandLine", default=""),
                            " /s -i powershell" in event.deep_get("CommandLine", default=""),
                            " /s /i powershell" in event.deep_get("CommandLine", default=""),
                            " /s –i powershell" in event.deep_get("CommandLine", default=""),
                            " /s —i powershell" in event.deep_get("CommandLine", default=""),
                            " /s ―i powershell" in event.deep_get("CommandLine", default=""),
                            " –s -i powershell" in event.deep_get("CommandLine", default=""),
                            " –s /i powershell" in event.deep_get("CommandLine", default=""),
                            " –s –i powershell" in event.deep_get("CommandLine", default=""),
                            " –s —i powershell" in event.deep_get("CommandLine", default=""),
                            " –s ―i powershell" in event.deep_get("CommandLine", default=""),
                            " —s -i powershell" in event.deep_get("CommandLine", default=""),
                            " —s /i powershell" in event.deep_get("CommandLine", default=""),
                            " —s –i powershell" in event.deep_get("CommandLine", default=""),
                            " —s —i powershell" in event.deep_get("CommandLine", default=""),
                            " —s ―i powershell" in event.deep_get("CommandLine", default=""),
                            " ―s -i powershell" in event.deep_get("CommandLine", default=""),
                            " ―s /i powershell" in event.deep_get("CommandLine", default=""),
                            " ―s –i powershell" in event.deep_get("CommandLine", default=""),
                            " ―s —i powershell" in event.deep_get("CommandLine", default=""),
                            " ―s ―i powershell" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            " -i -s powershell" in event.deep_get("CommandLine", default=""),
                            " -i /s powershell" in event.deep_get("CommandLine", default=""),
                            " -i –s powershell" in event.deep_get("CommandLine", default=""),
                            " -i —s powershell" in event.deep_get("CommandLine", default=""),
                            " -i ―s powershell" in event.deep_get("CommandLine", default=""),
                            " /i -s powershell" in event.deep_get("CommandLine", default=""),
                            " /i /s powershell" in event.deep_get("CommandLine", default=""),
                            " /i –s powershell" in event.deep_get("CommandLine", default=""),
                            " /i —s powershell" in event.deep_get("CommandLine", default=""),
                            " /i ―s powershell" in event.deep_get("CommandLine", default=""),
                            " –i -s powershell" in event.deep_get("CommandLine", default=""),
                            " –i /s powershell" in event.deep_get("CommandLine", default=""),
                            " –i –s powershell" in event.deep_get("CommandLine", default=""),
                            " –i —s powershell" in event.deep_get("CommandLine", default=""),
                            " –i ―s powershell" in event.deep_get("CommandLine", default=""),
                            " —i -s powershell" in event.deep_get("CommandLine", default=""),
                            " —i /s powershell" in event.deep_get("CommandLine", default=""),
                            " —i –s powershell" in event.deep_get("CommandLine", default=""),
                            " —i —s powershell" in event.deep_get("CommandLine", default=""),
                            " —i ―s powershell" in event.deep_get("CommandLine", default=""),
                            " ―i -s powershell" in event.deep_get("CommandLine", default=""),
                            " ―i /s powershell" in event.deep_get("CommandLine", default=""),
                            " ―i –s powershell" in event.deep_get("CommandLine", default=""),
                            " ―i —s powershell" in event.deep_get("CommandLine", default=""),
                            " ―i ―s powershell" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    "paexec" in event.deep_get("CommandLine", default=""),
                    "PsExec" in event.deep_get("CommandLine", default=""),
                    "accepteula" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
