def rule(event):
    if any(
        [
            any(
                [
                    any(
                        [
                            "QWRkLU1wUHJlZmVyZW5jZS" in event.deep_get("CommandLine", default=""),
                            "FkZC1NcFByZWZlcmVuY2Ug" in event.deep_get("CommandLine", default=""),
                            "BZGQtTXBQcmVmZXJlbmNlI" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "U2V0LU1wUHJlZmVyZW5jZS" in event.deep_get("CommandLine", default=""),
                            "NldC1NcFByZWZlcmVuY2Ug" in event.deep_get("CommandLine", default=""),
                            "TZXQtTXBQcmVmZXJlbmNlI" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "YWRkLW1wcHJlZmVyZW5jZS" in event.deep_get("CommandLine", default=""),
                            "FkZC1tcHByZWZlcmVuY2Ug" in event.deep_get("CommandLine", default=""),
                            "hZGQtbXBwcmVmZXJlbmNlI" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            "c2V0LW1wcHJlZmVyZW5jZS" in event.deep_get("CommandLine", default=""),
                            "NldC1tcHByZWZlcmVuY2Ug" in event.deep_get("CommandLine", default=""),
                            "zZXQtbXBwcmVmZXJlbmNlI" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                ]
            ),
            any(
                [
                    "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA"
                    in event.deep_get("CommandLine", default=""),
                    "EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA"
                    in event.deep_get("CommandLine", default=""),
                    "BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA"
                    in event.deep_get("CommandLine", default=""),
                    "UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA"
                    in event.deep_get("CommandLine", default=""),
                    "MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA"
                    in event.deep_get("CommandLine", default=""),
                    "TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA"
                    in event.deep_get("CommandLine", default=""),
                    "YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA"
                    in event.deep_get("CommandLine", default=""),
                    "EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA"
                    in event.deep_get("CommandLine", default=""),
                    "hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA"
                    in event.deep_get("CommandLine", default=""),
                    "cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA"
                    in event.deep_get("CommandLine", default=""),
                    "MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA"
                    in event.deep_get("CommandLine", default=""),
                    "zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA"
                    in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
