def rule(event):
    if any(
        [
            "Add-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "ConvertTo-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Disable-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Enable-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Export-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Find-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Get-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Grant-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Initialize-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Install-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Invoke-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Join-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "New-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Open-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Read-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Register-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Remove-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Reset-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Resolve-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Restore-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Save-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Search-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Send-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Set-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Start-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Unprotect-AADInt" in event.deep_get("ScriptBlockText", default=""),
            "Update-AADInt" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
