def rule(event):
    if any(
        [
            'Import-Module "$Env:Temp\\' in event.deep_get("CommandLine", default=""),
            "Import-Module '$Env:Temp\\" in event.deep_get("CommandLine", default=""),
            "Import-Module $Env:Temp\\" in event.deep_get("CommandLine", default=""),
            'Import-Module "$Env:Appdata\\' in event.deep_get("CommandLine", default=""),
            "Import-Module '$Env:Appdata\\" in event.deep_get("CommandLine", default=""),
            "Import-Module $Env:Appdata\\" in event.deep_get("CommandLine", default=""),
            "Import-Module C:\\Users\\Public\\" in event.deep_get("CommandLine", default=""),
            'ipmo "$Env:Temp\\' in event.deep_get("CommandLine", default=""),
            "ipmo '$Env:Temp\\" in event.deep_get("CommandLine", default=""),
            "ipmo $Env:Temp\\" in event.deep_get("CommandLine", default=""),
            'ipmo "$Env:Appdata\\' in event.deep_get("CommandLine", default=""),
            "ipmo '$Env:Appdata\\" in event.deep_get("CommandLine", default=""),
            "ipmo $Env:Appdata\\" in event.deep_get("CommandLine", default=""),
            "ipmo C:\\Users\\Public\\" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
