import json


def rule(event):
    if any(
        [
            any(
                [
                    "failed to unmarshal session(../" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(./../" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(/.." in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%2E%2E%2F" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%2F%2E%2E" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%2E%2F%2E%2E%2F" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%252E%252E%252F" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%252F%252E%252E" in json.dumps(event.to_dict()),
                    "failed to unmarshal session(%252E%252F%252E%252E%252F"
                    in json.dumps(event.to_dict()),
                ]
            ),
            all(
                [
                    any(
                        [
                            "{IFS}" in json.dumps(event.to_dict()),
                            "base64" in json.dumps(event.to_dict()),
                            "bash" in json.dumps(event.to_dict()),
                            "curl" in json.dumps(event.to_dict()),
                            "http" in json.dumps(event.to_dict()),
                        ]
                    ),
                    "/opt/panlogs/tmp/device_telemetry/" in json.dumps(event.to_dict()),
                ]
            ),
        ]
    ):
        return True
    return False
