def rule(event):
    if any(
        [
            all(
                [
                    "new-object" in event.deep_get("Destination", default=""),
                    "net.webclient" in event.deep_get("Destination", default=""),
                    ".downloadstring" in event.deep_get("Destination", default=""),
                ]
            ),
            all(
                [
                    "new-object" in event.deep_get("Destination", default=""),
                    "net.webclient" in event.deep_get("Destination", default=""),
                    ".downloadfile" in event.deep_get("Destination", default=""),
                ]
            ),
            any(
                [
                    " iex(" in event.deep_get("Destination", default=""),
                    " -nop " in event.deep_get("Destination", default=""),
                    " -noprofile " in event.deep_get("Destination", default=""),
                    " -decode " in event.deep_get("Destination", default=""),
                    " -enc " in event.deep_get("Destination", default=""),
                    "WScript.Shell" in event.deep_get("Destination", default=""),
                    "System.Security.Cryptography.FromBase64Transform"
                    in event.deep_get("Destination", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
