def rule(event):
    if all(
        [
            any(
                [
                    "Invoke-RestMethod" in event.deep_get("ScriptBlockText", default=""),
                    "Invoke-WebRequest" in event.deep_get("ScriptBlockText", default=""),
                    "irm " in event.deep_get("ScriptBlockText", default=""),
                    "iwr " in event.deep_get("ScriptBlockText", default=""),
                ]
            ),
            any(
                [
                    '-Method "POST"' in event.deep_get("ScriptBlockText", default=""),
                    '-Method "PUT"' in event.deep_get("ScriptBlockText", default=""),
                    "-Method POST" in event.deep_get("ScriptBlockText", default=""),
                    "-Method PUT" in event.deep_get("ScriptBlockText", default=""),
                    "-Method 'POST'" in event.deep_get("ScriptBlockText", default=""),
                    "-Method 'PUT'" in event.deep_get("ScriptBlockText", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
