def rule(event):
    if any(
        [
            ".CreationTime =" in event.deep_get("ScriptBlockText", default=""),
            ".LastWriteTime =" in event.deep_get("ScriptBlockText", default=""),
            ".LastAccessTime =" in event.deep_get("ScriptBlockText", default=""),
            "[IO.File]::SetCreationTime" in event.deep_get("ScriptBlockText", default=""),
            "[IO.File]::SetLastAccessTime" in event.deep_get("ScriptBlockText", default=""),
            "[IO.File]::SetLastWriteTime" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
