def rule(event):
    if all(
        [
            any(
                [
                    "cmd=read" in event.deep_get("cs-uri-query", default=""),
                    "connect&target" in event.deep_get("cs-uri-query", default=""),
                    "cmd=connect" in event.deep_get("cs-uri-query", default=""),
                    "cmd=disconnect" in event.deep_get("cs-uri-query", default=""),
                    "cmd=forward" in event.deep_get("cs-uri-query", default=""),
                ]
            ),
            event.deep_get("cs-referer", default="") == "",
            event.deep_get("cs-user-agent", default="") == "",
            event.deep_get("cs-method", default="") == "POST",
        ]
    ):
        return True
    return False
