def rule(event):
    if any(
        [
            "IEX ((New-Object Net.WebClient).DownloadString"
            in event.deep_get("CommandLine", default=""),
            "IEX (New-Object Net.WebClient).DownloadString"
            in event.deep_get("CommandLine", default=""),
            "IEX((New-Object Net.WebClient).DownloadString"
            in event.deep_get("CommandLine", default=""),
            "IEX(New-Object Net.WebClient).DownloadString"
            in event.deep_get("CommandLine", default=""),
            " -command (New-Object System.Net.WebClient).DownloadFile("
            in event.deep_get("CommandLine", default=""),
            " -c (New-Object System.Net.WebClient).DownloadFile("
            in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
