def rule(event):
    if any(
        [
            all(
                [
                    event.deep_get("cs-method", default="") == "POST",
                    "/owa/auth/Current/themes/resources/"
                    in event.deep_get("cs-uri-query", default=""),
                ]
            ),
            all(
                [
                    event.deep_get("cs-method", default="") == "POST",
                    "/owa/auth/Current/" in event.deep_get("cs-uri-query", default=""),
                    event.deep_get("cs-user-agent", default="")
                    in [
                        "DuckDuckBot/1.0;+(+http://duckduckgo.com/duckduckbot.html)",
                        "facebookexternalhit/1.1+(+http://www.facebook.com/externalhit_uatext.php)",
                        "Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)",
                        "Mozilla/5.0+(compatible;+Bingbot/2.0;++http://www.bing.com/bingbot.htm)",
                        "Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html",
                        "Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)",
                        "Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)",
                        "Mozilla/5.0+(compatible;+YandexBot/3.0;++http://yandex.com/bots)",
                        "Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36",
                    ],
                ]
            ),
            all(
                [
                    "/ecp/" in event.deep_get("cs-uri-query", default=""),
                    event.deep_get("cs-method", default="") == "POST",
                    event.deep_get("cs-user-agent", default="")
                    in [
                        "ExchangeServicesClient/0.0.0.0",
                        "python-requests/2.19.1",
                        "python-requests/2.25.1",
                    ],
                ]
            ),
            all(
                [
                    any(
                        [
                            "/aspnet_client/" in event.deep_get("cs-uri-query", default=""),
                            "/owa/" in event.deep_get("cs-uri-query", default=""),
                        ]
                    ),
                    event.deep_get("cs-method", default="") == "POST",
                    event.deep_get("cs-user-agent", default="")
                    in [
                        "antSword/v2.1",
                        "Googlebot/2.1+(+http://www.googlebot.com/bot.html)",
                        "Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)",
                    ],
                ]
            ),
            all(
                [
                    any(
                        [
                            "/owa/auth/Current/" in event.deep_get("cs-uri-query", default=""),
                            "/ecp/default.flt" in event.deep_get("cs-uri-query", default=""),
                            "/ecp/main.css" in event.deep_get("cs-uri-query", default=""),
                        ]
                    ),
                    event.deep_get("cs-method", default="") == "POST",
                ]
            ),
            all(
                [
                    event.deep_get("cs-method", default="") == "POST",
                    "/ecp/" in event.deep_get("cs-uri-query", default=""),
                    ".js" in event.deep_get("cs-uri-query", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
