import json


def rule(event):
    if all(
        [
            event.deep_get("cs-method", default="") == "GET",
            any(
                [
                    "@@version" in json.dumps(event.to_dict()),
                    "%271%27%3D%271" in json.dumps(event.to_dict()),
                    "=select " in json.dumps(event.to_dict()),
                    "=select(" in json.dumps(event.to_dict()),
                    "=select%20" in json.dumps(event.to_dict()),
                    "concat_ws(" in json.dumps(event.to_dict()),
                    "CONCAT(0x" in json.dumps(event.to_dict()),
                    "from mysql.innodb_table_stats" in json.dumps(event.to_dict()),
                    "from%20mysql.innodb_table_stats" in json.dumps(event.to_dict()),
                    "group_concat(" in json.dumps(event.to_dict()),
                    "information_schema.tables" in json.dumps(event.to_dict()),
                    "json_arrayagg(" in json.dumps(event.to_dict()),
                    "or 1=1#" in json.dumps(event.to_dict()),
                    "or%201=1#" in json.dumps(event.to_dict()),
                    "order by " in json.dumps(event.to_dict()),
                    "order%20by%20" in json.dumps(event.to_dict()),
                    "select * " in json.dumps(event.to_dict()),
                    "select database()" in json.dumps(event.to_dict()),
                    "select version()" in json.dumps(event.to_dict()),
                    "select%20*%20" in json.dumps(event.to_dict()),
                    "select%20database()" in json.dumps(event.to_dict()),
                    "select%20version()" in json.dumps(event.to_dict()),
                    "select%28sleep%2810%29" in json.dumps(event.to_dict()),
                    "SELECTCHAR(" in json.dumps(event.to_dict()),
                    "table_schema" in json.dumps(event.to_dict()),
                    "UNION ALL SELECT" in json.dumps(event.to_dict()),
                    "UNION SELECT" in json.dumps(event.to_dict()),
                    "UNION%20ALL%20SELECT" in json.dumps(event.to_dict()),
                    "UNION%20SELECT" in json.dumps(event.to_dict()),
                    "'1'='1" in json.dumps(event.to_dict()),
                ]
            ),
            not event.deep_get("sc-status", default="") == 404,
        ]
    ):
        return True
    return False
