def rule(event):
    if all(
        [
            any(
                [
                    any(
                        [
                            "New-ScheduledTaskAction"
                            in event.deep_get("ScriptBlockText", default=""),
                            "New-ScheduledTaskTrigger"
                            in event.deep_get("ScriptBlockText", default=""),
                            "New-ScheduledTaskPrincipal"
                            in event.deep_get("ScriptBlockText", default=""),
                            "New-ScheduledTaskSettingsSet"
                            in event.deep_get("ScriptBlockText", default=""),
                            "New-ScheduledTask" in event.deep_get("ScriptBlockText", default=""),
                            "Register-ScheduledTask"
                            in event.deep_get("ScriptBlockText", default=""),
                        ]
                    ),
                    all(
                        [
                            "Invoke-CimMethod" in event.deep_get("ScriptBlockText", default=""),
                            "-ClassName" in event.deep_get("ScriptBlockText", default=""),
                            "PS_ScheduledTask" in event.deep_get("ScriptBlockText", default=""),
                            "-NameSpace" in event.deep_get("ScriptBlockText", default=""),
                            "Root\\Microsoft\\Windows\\TaskScheduler"
                            in event.deep_get("ScriptBlockText", default=""),
                        ]
                    ),
                ]
            ),
            not all(
                [
                    "Microsoft.PowerShell.Core\\Export-ModuleMember"
                    in event.deep_get("ScriptBlockText", default=""),
                    "Microsoft.Management.Infrastructure.CimInstance"
                    in event.deep_get("ScriptBlockText", default=""),
                    "__cmdletization_methodParameter"
                    in event.deep_get("ScriptBlockText", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
