import json


def rule(event):
    if any(
        [
            "wget * - http* | perl" in json.dumps(event.to_dict()),
            "wget * - http* | sh" in json.dumps(event.to_dict()),
            "wget * - http* | bash" in json.dumps(event.to_dict()),
            "python -m SimpleHTTPServer" in json.dumps(event.to_dict()),
            "-m http.server" in json.dumps(event.to_dict()),
            "import pty; pty.spawn*" in json.dumps(event.to_dict()),
            "socat exec:*" in json.dumps(event.to_dict()),
            "socat -O /tmp/*" in json.dumps(event.to_dict()),
            "socat tcp-connect*" in json.dumps(event.to_dict()),
            "*echo binary >>*" in json.dumps(event.to_dict()),
            "*wget *; chmod +x*" in json.dumps(event.to_dict()),
            "*wget *; chmod 777 *" in json.dumps(event.to_dict()),
            "*cd /tmp || cd /var/run || cd /mnt*" in json.dumps(event.to_dict()),
            "*stop;service iptables stop;*" in json.dumps(event.to_dict()),
            "*stop;SuSEfirewall2 stop;*" in json.dumps(event.to_dict()),
            "chmod 777 2020*" in json.dumps(event.to_dict()),
            "*>>/etc/rc.local" in json.dumps(event.to_dict()),
            "*base64 -d /tmp/*" in json.dumps(event.to_dict()),
            "* | base64 -d *" in json.dumps(event.to_dict()),
            "*/chmod u+s *" in json.dumps(event.to_dict()),
            "*chmod +s /tmp/*" in json.dumps(event.to_dict()),
            "*chmod u+s /tmp/*" in json.dumps(event.to_dict()),
            "* /tmp/haxhax*" in json.dumps(event.to_dict()),
            "* /tmp/ns_sploit*" in json.dumps(event.to_dict()),
            "nc -l -p *" in json.dumps(event.to_dict()),
            "cp /bin/ksh *" in json.dumps(event.to_dict()),
            "cp /bin/sh *" in json.dumps(event.to_dict()),
            "* /tmp/*.b64 *" in json.dumps(event.to_dict()),
            "*/tmp/ysocereal.jar*" in json.dumps(event.to_dict()),
            "*/tmp/x *" in json.dumps(event.to_dict()),
            "*; chmod +x /tmp/*" in json.dumps(event.to_dict()),
            "*;chmod +x /tmp/*" in json.dumps(event.to_dict()),
        ]
    ):
        return True
    return False
