def rule(event):
    if all(
        [
            "cleanLL" in event.deep_get("ScriptBlockText", default=""),
            "usersfiles.war" in event.deep_get("ScriptBlockText", default=""),
            'Remove-Item -Path "$tomcat_dir' in event.deep_get("ScriptBlockText", default=""),
            "SysAidServer" in event.deep_get("ScriptBlockText", default=""),
            "sleep " in event.deep_get("ScriptBlockText", default=""),
            "while(1)" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
