def rule(event):
    if "System.DirectoryServices.AccountManagement" in event.deep_get(
        "ScriptBlockText", default=""
    ):
        return True
    return False
