def rule(event):
    if any(
        [
            "OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA" in event.deep_get("CommandLine", default=""),
            "OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACIATABvACIAKwAiAGEAZAAiACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA" in event.deep_get("CommandLine", default=""),
            "OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACIATABvAGEAIgArACIAZAAiACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA" in event.deep_get("CommandLine", default=""),
            "OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA" in event.deep_get("CommandLine", default=""),
            "OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACcATABvACcAKwAnAGEAZAAnACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA" in event.deep_get("CommandLine", default=""),
            "OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ" in event.deep_get("CommandLine", default=""),
            "oAOgAoACcATABvAGEAJwArACcAZAAnACkA" in event.deep_get("CommandLine", default=""),
            "6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
