import re


def rule(event):
    if all(
        [
            "/mifs/rs/api/v2/featureusage" in event.deep_get("cs-uri-stem", default=""),
            "format=" in event.deep_get("cs-uri-query", default=""),
            any(
                [
                    any(
                        [
                            all(
                                [
                                    "java.lang.Runtime"
                                    in event.deep_get("cs-uri-query", default=""),
                                    ".getMethod" in event.deep_get("cs-uri-query", default=""),
                                    "getRuntime" in event.deep_get("cs-uri-query", default=""),
                                    ".exec(" in event.deep_get("cs-uri-query", default=""),
                                ]
                            ),
                            all(
                                [
                                    "java%2elang%2eRuntime"
                                    in event.deep_get("cs-uri-query", default=""),
                                    "%2egetMethod" in event.deep_get("cs-uri-query", default=""),
                                    "%2eexec%28" in event.deep_get("cs-uri-query", default=""),
                                ]
                            ),
                            any(
                                [
                                    "%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%65%28%29"
                                    in event.deep_get("cs-uri-query", default=""),
                                    "%67%65%74%52%75%6e%74%69%6d%65"
                                    in event.deep_get("cs-uri-query", default=""),
                                    "%2e%65%78%65%63%28"
                                    in event.deep_get("cs-uri-query", default=""),
                                ]
                            ),
                        ]
                    ),
                    any(
                        [
                            re.match(r"^.*{7.*7}.*$", event.deep_get("cs-uri-query", default="")),
                            re.match(
                                r"^.*%7B7.*7%7D.*$", event.deep_get("cs-uri-query", default="")
                            ),
                            "%7b7%2a7%7d" in event.deep_get("cs-uri-query", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
