import re


def rule(event):
    if any(
        [
            re.match(
                r"\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[",
                event.deep_get("ScriptBlockText", default=""),
            ),
            re.match(
                r"\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[",
                event.deep_get("ScriptBlockText", default=""),
            ),
            re.match(
                r"\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[",
                event.deep_get("ScriptBlockText", default=""),
            ),
            re.match(
                r"\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}",
                event.deep_get("ScriptBlockText", default=""),
            ),
            re.match(r"\\*mdr\\*\\W\\s*\\)\\.Name", event.deep_get("ScriptBlockText", default="")),
            re.match(
                r"\\$VerbosePreference\\.ToString\\(", event.deep_get("ScriptBlockText", default="")
            ),
        ]
    ):
        return True
    return False
