def rule(event):
    if any(
        [
            any(
                [
                    any(
                        [
                            "SUVYIChb" in event.deep_get("CommandLine", default=""),
                            "lFWCAoW" in event.deep_get("CommandLine", default=""),
                            "JRVggKF" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "aWV4IChb" in event.deep_get("CommandLine", default=""),
                            "lleCAoW" in event.deep_get("CommandLine", default=""),
                            "pZXggKF" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "aWV4IChOZX" in event.deep_get("CommandLine", default=""),
                            "lleCAoTmV3" in event.deep_get("CommandLine", default=""),
                            "pZXggKE5ld" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "SUVYIChOZX" in event.deep_get("CommandLine", default=""),
                            "lFWCAoTmV3" in event.deep_get("CommandLine", default=""),
                            "JRVggKE5ld" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "SUVYKF" in event.deep_get("CommandLine", default=""),
                            "lFWChb" in event.deep_get("CommandLine", default=""),
                            "JRVgoW" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "aWV4KF" in event.deep_get("CommandLine", default=""),
                            "lleChb" in event.deep_get("CommandLine", default=""),
                            "pZXgoW" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "aWV4KE5ld" in event.deep_get("CommandLine", default=""),
                            "lleChOZX" in event.deep_get("CommandLine", default=""),
                            "pZXgoTmV3" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "SUVYKE5ld" in event.deep_get("CommandLine", default=""),
                            "lFWChOZX" in event.deep_get("CommandLine", default=""),
                            "JRVgoTmV3" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "SUVYKCgn" in event.deep_get("CommandLine", default=""),
                            "lFWCgoJ" in event.deep_get("CommandLine", default=""),
                            "JRVgoKC" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "aWV4KCgn" in event.deep_get("CommandLine", default=""),
                            "lleCgoJ" in event.deep_get("CommandLine", default=""),
                            "pZXgoKC" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            any(
                [
                    "SQBFAFgAIAAoAFsA" in event.deep_get("CommandLine", default=""),
                    "kARQBYACAAKABbA" in event.deep_get("CommandLine", default=""),
                    "JAEUAWAAgACgAWw" in event.deep_get("CommandLine", default=""),
                    "aQBlAHgAIAAoAFsA" in event.deep_get("CommandLine", default=""),
                    "kAZQB4ACAAKABbA" in event.deep_get("CommandLine", default=""),
                    "pAGUAeAAgACgAWw" in event.deep_get("CommandLine", default=""),
                    "aQBlAHgAIAAoAE4AZQB3A" in event.deep_get("CommandLine", default=""),
                    "kAZQB4ACAAKABOAGUAdw" in event.deep_get("CommandLine", default=""),
                    "pAGUAeAAgACgATgBlAHcA" in event.deep_get("CommandLine", default=""),
                    "SQBFAFgAIAAoAE4AZQB3A" in event.deep_get("CommandLine", default=""),
                    "kARQBYACAAKABOAGUAdw" in event.deep_get("CommandLine", default=""),
                    "JAEUAWAAgACgATgBlAHcA" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
