def rule(event):
    if all(
        [
            any(
                [
                    ".DownloadString(" in event.deep_get("CommandLine", default=""),
                    ".DownloadFile(" in event.deep_get("CommandLine", default=""),
                    "Invoke-WebRequest " in event.deep_get("CommandLine", default=""),
                    "iwr " in event.deep_get("CommandLine", default=""),
                    "Invoke-RestMethod " in event.deep_get("CommandLine", default=""),
                    "irm " in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    ";iex $" in event.deep_get("CommandLine", default=""),
                    "| IEX" in event.deep_get("CommandLine", default=""),
                    "|IEX " in event.deep_get("CommandLine", default=""),
                    "I`E`X" in event.deep_get("CommandLine", default=""),
                    "I`EX" in event.deep_get("CommandLine", default=""),
                    "IE`X" in event.deep_get("CommandLine", default=""),
                    "iex " in event.deep_get("CommandLine", default=""),
                    "IEX (" in event.deep_get("CommandLine", default=""),
                    "IEX(" in event.deep_get("CommandLine", default=""),
                    "Invoke-Expression" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
