def rule(event):
    if any(
        [
            "asreproast " in event.deep_get("ScriptBlockText", default=""),
            "dump /service:krbtgt " in event.deep_get("ScriptBlockText", default=""),
            "dump /luid:0x" in event.deep_get("ScriptBlockText", default=""),
            "kerberoast " in event.deep_get("ScriptBlockText", default=""),
            "createnetonly /program:" in event.deep_get("ScriptBlockText", default=""),
            "ptt /ticket:" in event.deep_get("ScriptBlockText", default=""),
            "/impersonateuser:" in event.deep_get("ScriptBlockText", default=""),
            "renew /ticket:" in event.deep_get("ScriptBlockText", default=""),
            "asktgt /user:" in event.deep_get("ScriptBlockText", default=""),
            "harvest /interval:" in event.deep_get("ScriptBlockText", default=""),
            "s4u /user:" in event.deep_get("ScriptBlockText", default=""),
            "s4u /ticket:" in event.deep_get("ScriptBlockText", default=""),
            "hash /password:" in event.deep_get("ScriptBlockText", default=""),
            "golden /aes256:" in event.deep_get("ScriptBlockText", default=""),
            "silver /user:" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
