def rule(event):
    if all(
        [
            "/irj/" in event.deep_get("cs-uri-stem", default=""),
            ".jsp" in event.deep_get("cs-uri-stem", default=""),
            any(
                [
                    any(
                        [
                            event.deep_get("cs-uri-query", default="").startswith("cmd="),
                            event.deep_get("cs-uri-query", default="").startswith("command="),
                            event.deep_get("cs-uri-query", default="").startswith("exec_cmd="),
                            event.deep_get("cs-uri-query", default="").startswith("exec="),
                        ]
                    ),
                    any(
                        [
                            "/dev/tcp" in event.deep_get("cs-uri-query", default=""),
                            "/etc/passwd" in event.deep_get("cs-uri-query", default=""),
                            "%2fdev%2ftcp" in event.deep_get("cs-uri-query", default=""),
                            "%2fetc%2fpasswd" in event.deep_get("cs-uri-query", default=""),
                            "=uname" in event.deep_get("cs-uri-query", default=""),
                            "=whoami" in event.deep_get("cs-uri-query", default=""),
                            "ifconfig" in event.deep_get("cs-uri-query", default=""),
                            "ping" in event.deep_get("cs-uri-query", default=""),
                            "pwd" in event.deep_get("cs-uri-query", default=""),
                        ]
                    ),
                    all(
                        [
                            "echo" in event.deep_get("cs-uri-query", default=""),
                            "base64" in event.deep_get("cs-uri-query", default=""),
                        ]
                    ),
                ]
            ),
        ]
    ):
        return True
    return False
