def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("type", default="") == "EXECVE",
                    event.deep_get("a0", default="") == "iptables",
                    "DROP" in event.deep_get("a1", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("type", default="") == "EXECVE",
                    event.deep_get("a0", default="") == "firewall-cmd",
                    "remove" in event.deep_get("a1", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("type", default="") == "EXECVE",
                    event.deep_get("a0", default="") == "ufw",
                    "delete" in event.deep_get("a1", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("type", default="") == "EXECVE",
                    event.deep_get("a0", default="") == "nft",
                    any(
                        [
                            "delete" in event.deep_get("a1", default=""),
                            "flush" in event.deep_get("a1", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
