import re


def rule(event):
    if all(
        [
            any(
                [
                    re.match(r"^.* -e.* PAA.*$", event.deep_get("CommandLine", default="")),
                    "JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ"
                    in event.deep_get("CommandLine", default=""),
                    "QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA"
                    in event.deep_get("CommandLine", default=""),
                    "kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA"
                    in event.deep_get("CommandLine", default=""),
                    "IgAoACcAKgAnACkAOwAkA" in event.deep_get("CommandLine", default=""),
                    "IAKAAnACoAJwApADsAJA" in event.deep_get("CommandLine", default=""),
                    "iACgAJwAqACcAKQA7ACQA" in event.deep_get("CommandLine", default=""),
                    "JABGAGwAeAByAGgAYwBmAGQ" in event.deep_get("CommandLine", default=""),
                    "PQAkAGUAbgB2ADoAdABlAG0AcAArACgA" in event.deep_get("CommandLine", default=""),
                    "0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA" in event.deep_get("CommandLine", default=""),
                    "9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA" in event.deep_get("CommandLine", default=""),
                ]
            ),
            not any(
                [
                    "fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ"
                    in event.deep_get("CommandLine", default=""),
                    "wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
                    in event.deep_get("CommandLine", default=""),
                    "8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA"
                    in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
