def rule(event):
    if all(
        [
            "IO.Compression.DeflateStream" in event.deep_get("ScriptBlockText", default=""),
            "IO.MemoryStream" in event.deep_get("ScriptBlockText", default=""),
            "::FromBase64String" in event.deep_get("ScriptBlockText", default=""),
            "GetDelegateForFunctionPointer" in event.deep_get("ScriptBlockText", default=""),
            ".Invoke()" in event.deep_get("ScriptBlockText", default=""),
            "GlobalAssemblyCache" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
