def rule(event):
    if any(
        [
            "akamaicontainer.com" in event.deep_get("QueryName", default=""),
            "akamaitechcloudservices.com" in event.deep_get("QueryName", default=""),
            "azuredeploystore.com" in event.deep_get("QueryName", default=""),
            "azureonlinecloud.com" in event.deep_get("QueryName", default=""),
            "azureonlinestorage.com" in event.deep_get("QueryName", default=""),
            "dunamistrd.com" in event.deep_get("QueryName", default=""),
            "glcloudservice.com" in event.deep_get("QueryName", default=""),
            "journalide.org" in event.deep_get("QueryName", default=""),
            "msedgepackageinfo.com" in event.deep_get("QueryName", default=""),
            "msedgeupdate.net" in event.deep_get("QueryName", default=""),
            "msstorageazure.com" in event.deep_get("QueryName", default=""),
            "msstorageboxes.com" in event.deep_get("QueryName", default=""),
            "officeaddons.com" in event.deep_get("QueryName", default=""),
            "officestoragebox.com" in event.deep_get("QueryName", default=""),
            "pbxcloudeservices.com" in event.deep_get("QueryName", default=""),
            "pbxphonenetwork.com" in event.deep_get("QueryName", default=""),
            "pbxsources.com" in event.deep_get("QueryName", default=""),
            "qwepoi123098.com" in event.deep_get("QueryName", default=""),
            "sbmsa.wiki" in event.deep_get("QueryName", default=""),
            "sourceslabs.com" in event.deep_get("QueryName", default=""),
            "visualstudiofactory.com" in event.deep_get("QueryName", default=""),
            "zacharryblogs.com" in event.deep_get("QueryName", default=""),
        ]
    ):
        return True
    return False
