def rule(event):
    if all(
        [
            "[System.Math]::" in event.deep_get("ScriptBlockText", default=""),
            "[IO.FileMode]::" in event.deep_get("ScriptBlockText", default=""),
            "BinaryWriter" in event.deep_get("ScriptBlockText", default=""),
            "0x52" in event.deep_get("ScriptBlockText", default=""),
            "0x49" in event.deep_get("ScriptBlockText", default=""),
            "0x46" in event.deep_get("ScriptBlockText", default=""),
            "0x57" in event.deep_get("ScriptBlockText", default=""),
            "0x41" in event.deep_get("ScriptBlockText", default=""),
            "0x56" in event.deep_get("ScriptBlockText", default=""),
            "0x45" in event.deep_get("ScriptBlockText", default=""),
            "0xAC" in event.deep_get("ScriptBlockText", default=""),
        ]
    ):
        return True
    return False
