def rule(event):
    if any(
        [
            " --cpu-priority=" in event.deep_get("CommandLine", default=""),
            "--donate-level=0" in event.deep_get("CommandLine", default=""),
            " -o pool." in event.deep_get("CommandLine", default=""),
            " --nicehash" in event.deep_get("CommandLine", default=""),
            " --algo=rx/0 " in event.deep_get("CommandLine", default=""),
            "stratum+tcp://" in event.deep_get("CommandLine", default=""),
            "stratum+udp://" in event.deep_get("CommandLine", default=""),
            "sh -c /sbin/modprobe msr allow_writes=on" in event.deep_get("CommandLine", default=""),
            "LS1kb25hdGUtbGV2ZWw9" in event.deep_get("CommandLine", default=""),
            "0tZG9uYXRlLWxldmVsP" in event.deep_get("CommandLine", default=""),
            "tLWRvbmF0ZS1sZXZlbD" in event.deep_get("CommandLine", default=""),
            "c3RyYXR1bSt0Y3A6Ly" in event.deep_get("CommandLine", default=""),
            "N0cmF0dW0rdGNwOi8v" in event.deep_get("CommandLine", default=""),
            "zdHJhdHVtK3RjcDovL" in event.deep_get("CommandLine", default=""),
            "c3RyYXR1bSt1ZHA6Ly" in event.deep_get("CommandLine", default=""),
            "N0cmF0dW0rdWRwOi8v" in event.deep_get("CommandLine", default=""),
            "zdHJhdHVtK3VkcDovL" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
