import json


def rule(event):
    if any(
        [
            "chown root*chmod 4777 " in json.dumps(event.to_dict()),
            "cp /bin/sh .;chown" in json.dumps(event.to_dict()),
            "chmod 4777 /tmp/.scsi/dev/bin/gsh" in json.dumps(event.to_dict()),
            "chown root:root /tmp/.scsi/dev/bin/" in json.dumps(event.to_dict()),
            "chown root:root x;" in json.dumps(event.to_dict()),
            "/bin/telnet locip locport < /dev/console | /bin/sh" in json.dumps(event.to_dict()),
            "/tmp/ratload" in json.dumps(event.to_dict()),
            "ewok -t " in json.dumps(event.to_dict()),
            "xspy -display " in json.dumps(event.to_dict()),
            "cat > /dev/tcp/127.0.0.1/80 <<END" in json.dumps(event.to_dict()),
            "rm -f /current/tmp/ftshell.latest" in json.dumps(event.to_dict()),
            "ghost_* -v " in json.dumps(event.to_dict()),
            " --wipe > /dev/null" in json.dumps(event.to_dict()),
            "ping -c 2 *; grep * /proc/net/arp >/tmp/gx" in json.dumps(event.to_dict()),
            "iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;"
            in json.dumps(event.to_dict()),
            "> /var/log/audit/audit.log; rm -f ." in json.dumps(event.to_dict()),
            "cp /var/log/audit/audit.log .tmp" in json.dumps(event.to_dict()),
            "sh >/dev/tcp/* <&1 2>&1" in json.dumps(event.to_dict()),
            "ncat -vv -l -p * <" in json.dumps(event.to_dict()),
            "nc -vv -l -p * <" in json.dumps(event.to_dict()),
            "< /dev/console | uudecode && uncompress" in json.dumps(event.to_dict()),
            "sendmail -osendmail;chmod +x sendmail" in json.dumps(event.to_dict()),
            "/usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron" in json.dumps(event.to_dict()),
            "chmod 666 /var/run/utmp~" in json.dumps(event.to_dict()),
            "chmod 700 nscd crond" in json.dumps(event.to_dict()),
            "cp /etc/shadow /tmp/." in json.dumps(event.to_dict()),
            "</dev/console |uudecode > /dev/null 2>&1 && uncompress" in json.dumps(event.to_dict()),
            "chmod 700 jp&&netstat -an|grep" in json.dumps(event.to_dict()),
            "uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755"
            in json.dumps(event.to_dict()),
            "chmod 700 crond" in json.dumps(event.to_dict()),
            "wget http*; chmod +x /tmp/sendmail" in json.dumps(event.to_dict()),
            "chmod 700 fp sendmail pt" in json.dumps(event.to_dict()),
            "chmod 755 /usr/vmsys/bin/pipe" in json.dumps(event.to_dict()),
            "chmod -R 755 /usr/vmsys" in json.dumps(event.to_dict()),
            "chmod 755 $opbin/*tunnel" in json.dumps(event.to_dict()),
            "chmod 700 sendmail" in json.dumps(event.to_dict()),
            "chmod 0700 sendmail" in json.dumps(event.to_dict()),
            "/usr/bin/wget http*sendmail;chmod +x sendmail;" in json.dumps(event.to_dict()),
            "&& telnet * 2>&1 </dev/console" in json.dumps(event.to_dict()),
        ]
    ):
        return True
    return False
