def rule(event):
    if any(
        [
            any(
                [
                    "OjpGcm9tQmFzZTY0U3RyaW5n" in event.deep_get("CommandLine", default=""),
                    "o6RnJvbUJhc2U2NFN0cmluZ" in event.deep_get("CommandLine", default=""),
                    "6OkZyb21CYXNlNjRTdHJpbm" in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    "OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA"
                    in event.deep_get("CommandLine", default=""),
                    "oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA"
                    in event.deep_get("CommandLine", default=""),
                    "6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw"
                    in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
