import json


def rule(event):
    if any(
        [
            'BEGIN {s = "/inet/tcp/0/' in json.dumps(event.to_dict()),
            "bash -i >& /dev/tcp/" in json.dumps(event.to_dict()),
            "bash -i >& /dev/udp/" in json.dumps(event.to_dict()),
            "sh -i >$ /dev/udp/" in json.dumps(event.to_dict()),
            "sh -i >$ /dev/tcp/" in json.dumps(event.to_dict()),
            "&& while read line 0<&5; do" in json.dumps(event.to_dict()),
            "/bin/bash -c exec 5<>/dev/tcp/" in json.dumps(event.to_dict()),
            "/bin/bash -c exec 5<>/dev/udp/" in json.dumps(event.to_dict()),
            "nc -e /bin/sh " in json.dumps(event.to_dict()),
            "/bin/sh | nc" in json.dumps(event.to_dict()),
            "rm -f backpipe; mknod /tmp/backpipe p && nc " in json.dumps(event.to_dict()),
            ';socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i))))'
            in json.dumps(event.to_dict()),
            ";STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;"
            in json.dumps(event.to_dict()),
            "/bin/sh -i <&3 >&3 2>&3" in json.dumps(event.to_dict()),
            "uname -a; w; id; /bin/bash -i" in json.dumps(event.to_dict()),
            "$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};"
            in json.dumps(event.to_dict()),
            ";os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null');"
            in json.dumps(event.to_dict()),
            '.to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' in json.dumps(event.to_dict()),
            ';while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print' in json.dumps(event.to_dict()),
            "socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:"
            in json.dumps(event.to_dict()),
            "rm -f /tmp/p; mknod /tmp/p p &&" in json.dumps(event.to_dict()),
            " | /bin/bash | telnet " in json.dumps(event.to_dict()),
            ",echo=0,raw tcp-listen:" in json.dumps(event.to_dict()),
            "nc -lvvp " in json.dumps(event.to_dict()),
            "xterm -display 1" in json.dumps(event.to_dict()),
        ]
    ):
        return True
    return False
