def rule(event):
    if any(
        [
            "[System.Net.WebRequest]::create" in event.deep_get("CommandLine", default=""),
            "curl " in event.deep_get("CommandLine", default=""),
            "Invoke-RestMethod" in event.deep_get("CommandLine", default=""),
            "Invoke-WebRequest" in event.deep_get("CommandLine", default=""),
            " irm " in event.deep_get("CommandLine", default=""),
            "iwr " in event.deep_get("CommandLine", default=""),
            "Resume-BitsTransfer" in event.deep_get("CommandLine", default=""),
            "Start-BitsTransfer" in event.deep_get("CommandLine", default=""),
            "wget " in event.deep_get("CommandLine", default=""),
            "WinHttp.WinHttpRequest" in event.deep_get("CommandLine", default=""),
        ]
    ):
        return True
    return False
