def rule(event):
    if all(
        [
            "echo 1 >" in event.deep_get("CommandLine", default=""),
            "/sys/kernel/debug/tracing/events/kprobes/"
            in event.deep_get("CommandLine", default=""),
            any(
                [
                    "/myprobe/enable" in event.deep_get("CommandLine", default=""),
                    "/myretprobe/enable" in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
