def rule(event):
    if any(
        [
            "Add-ADDBSidHistory" in event.deep_get("CommandLine", default=""),
            "Add-ADNgcKey" in event.deep_get("CommandLine", default=""),
            "Add-ADReplNgcKey" in event.deep_get("CommandLine", default=""),
            "ConvertFrom-ADManagedPasswordBlob" in event.deep_get("CommandLine", default=""),
            "ConvertFrom-GPPrefPassword" in event.deep_get("CommandLine", default=""),
            "ConvertFrom-ManagedPasswordBlob" in event.deep_get("CommandLine", default=""),
            "ConvertFrom-UnattendXmlPassword" in event.deep_get("CommandLine", default=""),
            "ConvertFrom-UnicodePassword" in event.deep_get("CommandLine", default=""),
            "ConvertTo-AADHash" in event.deep_get("CommandLine", default=""),
            "ConvertTo-GPPrefPassword" in event.deep_get("CommandLine", default=""),
            "ConvertTo-KerberosKey" in event.deep_get("CommandLine", default=""),
            "ConvertTo-LMHash" in event.deep_get("CommandLine", default=""),
            "ConvertTo-MsoPasswordHash" in event.deep_get("CommandLine", default=""),
            "ConvertTo-NTHash" in event.deep_get("CommandLine", default=""),
            "ConvertTo-OrgIdHash" in event.deep_get("CommandLine", default=""),
            "ConvertTo-UnicodePassword" in event.deep_get("CommandLine", default=""),
            "Disable-ADDBAccount" in event.deep_get("CommandLine", default=""),
            "Enable-ADDBAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADDBAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADDBBackupKey" in event.deep_get("CommandLine", default=""),
            "Get-ADDBDomainController" in event.deep_get("CommandLine", default=""),
            "Get-ADDBGroupManagedServiceAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADDBKdsRootKey" in event.deep_get("CommandLine", default=""),
            "Get-ADDBSchemaAttribute" in event.deep_get("CommandLine", default=""),
            "Get-ADDBServiceAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADDefaultPasswordPolicy" in event.deep_get("CommandLine", default=""),
            "Get-ADKeyCredential" in event.deep_get("CommandLine", default=""),
            "Get-ADPasswordPolicy" in event.deep_get("CommandLine", default=""),
            "Get-ADReplAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADReplBackupKey" in event.deep_get("CommandLine", default=""),
            "Get-ADReplicationAccount" in event.deep_get("CommandLine", default=""),
            "Get-ADSIAccount" in event.deep_get("CommandLine", default=""),
            "Get-AzureADUserEx" in event.deep_get("CommandLine", default=""),
            "Get-BootKey" in event.deep_get("CommandLine", default=""),
            "Get-KeyCredential" in event.deep_get("CommandLine", default=""),
            "Get-LsaBackupKey" in event.deep_get("CommandLine", default=""),
            "Get-LsaPolicy" in event.deep_get("CommandLine", default=""),
            "Get-SamPasswordPolicy" in event.deep_get("CommandLine", default=""),
            "Get-SysKey" in event.deep_get("CommandLine", default=""),
            "Get-SystemKey" in event.deep_get("CommandLine", default=""),
            "New-ADDBRestoreFromMediaScript" in event.deep_get("CommandLine", default=""),
            "New-ADKeyCredential" in event.deep_get("CommandLine", default=""),
            "New-ADNgcKey" in event.deep_get("CommandLine", default=""),
            "New-NTHashSet" in event.deep_get("CommandLine", default=""),
            "Remove-ADDBObject" in event.deep_get("CommandLine", default=""),
            "Save-DPAPIBlob" in event.deep_get("CommandLine", default=""),
            "Set-ADAccountPasswordHash" in event.deep_get("CommandLine", default=""),
            "Set-ADDBAccountPassword" in event.deep_get("CommandLine", default=""),
            "Set-ADDBBootKey" in event.deep_get("CommandLine", default=""),
            "Set-ADDBDomainController" in event.deep_get("CommandLine", default=""),
            "Set-ADDBPrimaryGroup" in event.deep_get("CommandLine", default=""),
            "Set-ADDBSysKey" in event.deep_get("CommandLine", default=""),
            "Set-AzureADUserEx" in event.deep_get("CommandLine", default=""),
            "Set-LsaPolicy" in event.deep_get("CommandLine", default=""),
            "Set-SamAccountPasswordHash" in event.deep_get("CommandLine", default=""),
            "Set-WinUserPasswordHash" in event.deep_get("CommandLine", default=""),
            "Test-ADDBPasswordQuality" in event.deep_get("CommandLine", default=""),
            "Test-ADPasswordQuality" in event.deep_get("CommandLine", default=""),
            "Test-ADReplPasswordQuality" in event.deep_get("CommandLine", default=""),
            "Test-PasswordQuality" in event.deep_get("CommandLine", default=""),
            "Unlock-ADDBAccount" in event.deep_get("CommandLine", default=""),
            "Write-ADNgcKey" in event.deep_get("CommandLine", default=""),
            "Write-ADReplNgcKey" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
