def rule(event):
    if any(
        [
            "(hydra)" in event.deep_get("c-useragent", default=""),
            " arachni/" in event.deep_get("c-useragent", default=""),
            " BFAC " in event.deep_get("c-useragent", default=""),
            " brutus " in event.deep_get("c-useragent", default=""),
            " cgichk " in event.deep_get("c-useragent", default=""),
            "core-project/1.0" in event.deep_get("c-useragent", default=""),
            " crimscanner/" in event.deep_get("c-useragent", default=""),
            "datacha0s" in event.deep_get("c-useragent", default=""),
            "dirbuster" in event.deep_get("c-useragent", default=""),
            "domino hunter" in event.deep_get("c-useragent", default=""),
            "dotdotpwn" in event.deep_get("c-useragent", default=""),
            "FHScan Core" in event.deep_get("c-useragent", default=""),
            "floodgate" in event.deep_get("c-useragent", default=""),
            "get-minimal" in event.deep_get("c-useragent", default=""),
            "gootkit auto-rooter scanner" in event.deep_get("c-useragent", default=""),
            "grendel-scan" in event.deep_get("c-useragent", default=""),
            " inspath " in event.deep_get("c-useragent", default=""),
            "internet ninja" in event.deep_get("c-useragent", default=""),
            "jaascois" in event.deep_get("c-useragent", default=""),
            " zmeu " in event.deep_get("c-useragent", default=""),
            "masscan" in event.deep_get("c-useragent", default=""),
            " metis " in event.deep_get("c-useragent", default=""),
            "morfeus fucking scanner" in event.deep_get("c-useragent", default=""),
            "n-stealth" in event.deep_get("c-useragent", default=""),
            "nsauditor" in event.deep_get("c-useragent", default=""),
            "pmafind" in event.deep_get("c-useragent", default=""),
            "security scan" in event.deep_get("c-useragent", default=""),
            "springenwerk" in event.deep_get("c-useragent", default=""),
            "teh forest lobster" in event.deep_get("c-useragent", default=""),
            "toata dragostea" in event.deep_get("c-useragent", default=""),
            " vega/" in event.deep_get("c-useragent", default=""),
            "voideye" in event.deep_get("c-useragent", default=""),
            "webshag" in event.deep_get("c-useragent", default=""),
            "webvulnscan" in event.deep_get("c-useragent", default=""),
            " whcc/" in event.deep_get("c-useragent", default=""),
            " Havij" in event.deep_get("c-useragent", default=""),
            "absinthe" in event.deep_get("c-useragent", default=""),
            "bsqlbf" in event.deep_get("c-useragent", default=""),
            "mysqloit" in event.deep_get("c-useragent", default=""),
            "pangolin" in event.deep_get("c-useragent", default=""),
            "sql power injector" in event.deep_get("c-useragent", default=""),
            "sqlmap" in event.deep_get("c-useragent", default=""),
            "sqlninja" in event.deep_get("c-useragent", default=""),
            "uil2pn" in event.deep_get("c-useragent", default=""),
            "ruler" in event.deep_get("c-useragent", default=""),
            "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
            in event.deep_get("c-useragent", default=""),
        ]
    ):
        return True
    return False
