def rule(event):
    if any(
        [
            "IAAtAGIAeABvAHIAIAAwAHgA" in event.deep_get("CommandLine", default=""),
            "AALQBiAHgAbwByACAAMAB4A" in event.deep_get("CommandLine", default=""),
            "gAC0AYgB4AG8AcgAgADAAeA" in event.deep_get("CommandLine", default=""),
            "AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg" in event.deep_get("CommandLine", default=""),
            "AuAEkAbgB2AG8AawBlACgAKQAgAHwAI" in event.deep_get("CommandLine", default=""),
            "ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC" in event.deep_get("CommandLine", default=""),
            "AHsAMQB9AHsAMAB9ACIAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADEAfQB7ADAAfQAiACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAxAH0AewAwAH0AIgAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
            "AHsAMAB9AHsAMwB9ACIAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADAAfQB7ADMAfQAiACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAwAH0AewAzAH0AIgAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
            "AHsAMgB9AHsAMAB9ACIAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADIAfQB7ADAAfQAiACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAyAH0AewAwAH0AIgAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
            "AHsAMQB9AHsAMAB9ACcAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADEAfQB7ADAAfQAnACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAxAH0AewAwAH0AJwAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
            "AHsAMAB9AHsAMwB9ACcAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADAAfQB7ADMAfQAnACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAwAH0AewAzAH0AJwAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
            "AHsAMgB9AHsAMAB9ACcAIAAtAGYAI" in event.deep_get("CommandLine", default=""),
            "B7ADIAfQB7ADAAfQAnACAALQBmAC" in event.deep_get("CommandLine", default=""),
            "AewAyAH0AewAwAH0AJwAgAC0AZgAg" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
