def rule(event):
    if any(
        [
            any(
                [
                    any(
                        [
                            "Temp\\wtask.exe /create" in event.deep_get("CommandLine", default=""),
                            "%windir:~-3,1%%PUBLIC:~-9,1%"
                            in event.deep_get("CommandLine", default=""),
                            '/tn "Security Script ' in event.deep_get("CommandLine", default=""),
                            "%windir:~-1,1%" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "/E:vbscript" in event.deep_get("CommandLine", default=""),
                            "C:\\Users\\" in event.deep_get("CommandLine", default=""),
                            ".txt" in event.deep_get("CommandLine", default=""),
                            "/F" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            event.deep_get("Image", default="").endswith("Temp\\winwsh.exe"),
        ]
    ):
        return True
    return False
