def rule(event):
    if any(
        [
            any(
                [
                    "${jndi:ldap:/" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:rmi:/" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:ldaps:/" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:dns:/" in event.deep_get("cs-user-agent", default=""),
                    "/$%7bjndi:" in event.deep_get("cs-user-agent", default=""),
                    "%24%7bjndi:" in event.deep_get("cs-user-agent", default=""),
                    "$%7Bjndi:" in event.deep_get("cs-user-agent", default=""),
                    "%2524%257Bjndi" in event.deep_get("cs-user-agent", default=""),
                    "%2F%252524%25257Bjndi%3A" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:${lower:" in event.deep_get("cs-user-agent", default=""),
                    "${::-j}${" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:nis" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:nds" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:corba" in event.deep_get("cs-user-agent", default=""),
                    "${jndi:iiop" in event.deep_get("cs-user-agent", default=""),
                    "Reference Class Name: foo" in event.deep_get("cs-user-agent", default=""),
                    "${${env:BARFOO:-j}" in event.deep_get("cs-user-agent", default=""),
                    "${::-l}${::-d}${::-a}${::-p}" in event.deep_get("cs-user-agent", default=""),
                    "${base64:JHtqbmRp" in event.deep_get("cs-user-agent", default=""),
                    "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$"
                    in event.deep_get("cs-user-agent", default=""),
                    "${${lower:j}ndi:" in event.deep_get("cs-user-agent", default=""),
                    "${${upper:j}ndi:" in event.deep_get("cs-user-agent", default=""),
                    "${${::-j}${::-n}${::-d}${::-i}:"
                    in event.deep_get("cs-user-agent", default=""),
                ]
            ),
            any(
                [
                    "${jndi:ldap:/" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:rmi:/" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:ldaps:/" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:dns:/" in event.deep_get("cs-uri-query", default=""),
                    "/$%7bjndi:" in event.deep_get("cs-uri-query", default=""),
                    "%24%7bjndi:" in event.deep_get("cs-uri-query", default=""),
                    "$%7Bjndi:" in event.deep_get("cs-uri-query", default=""),
                    "%2524%257Bjndi" in event.deep_get("cs-uri-query", default=""),
                    "%2F%252524%25257Bjndi%3A" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:${lower:" in event.deep_get("cs-uri-query", default=""),
                    "${::-j}${" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:nis" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:nds" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:corba" in event.deep_get("cs-uri-query", default=""),
                    "${jndi:iiop" in event.deep_get("cs-uri-query", default=""),
                    "Reference Class Name: foo" in event.deep_get("cs-uri-query", default=""),
                    "${${env:BARFOO:-j}" in event.deep_get("cs-uri-query", default=""),
                    "${::-l}${::-d}${::-a}${::-p}" in event.deep_get("cs-uri-query", default=""),
                    "${base64:JHtqbmRp" in event.deep_get("cs-uri-query", default=""),
                    "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$"
                    in event.deep_get("cs-uri-query", default=""),
                    "${${lower:j}ndi:" in event.deep_get("cs-uri-query", default=""),
                    "${${upper:j}ndi:" in event.deep_get("cs-uri-query", default=""),
                    "${${::-j}${::-n}${::-d}${::-i}:" in event.deep_get("cs-uri-query", default=""),
                ]
            ),
            any(
                [
                    "${jndi:ldap:/" in event.deep_get("cs-referer", default=""),
                    "${jndi:rmi:/" in event.deep_get("cs-referer", default=""),
                    "${jndi:ldaps:/" in event.deep_get("cs-referer", default=""),
                    "${jndi:dns:/" in event.deep_get("cs-referer", default=""),
                    "/$%7bjndi:" in event.deep_get("cs-referer", default=""),
                    "%24%7bjndi:" in event.deep_get("cs-referer", default=""),
                    "$%7Bjndi:" in event.deep_get("cs-referer", default=""),
                    "%2524%257Bjndi" in event.deep_get("cs-referer", default=""),
                    "%2F%252524%25257Bjndi%3A" in event.deep_get("cs-referer", default=""),
                    "${jndi:${lower:" in event.deep_get("cs-referer", default=""),
                    "${::-j}${" in event.deep_get("cs-referer", default=""),
                    "${jndi:nis" in event.deep_get("cs-referer", default=""),
                    "${jndi:nds" in event.deep_get("cs-referer", default=""),
                    "${jndi:corba" in event.deep_get("cs-referer", default=""),
                    "${jndi:iiop" in event.deep_get("cs-referer", default=""),
                    "Reference Class Name: foo" in event.deep_get("cs-referer", default=""),
                    "${${env:BARFOO:-j}" in event.deep_get("cs-referer", default=""),
                    "${::-l}${::-d}${::-a}${::-p}" in event.deep_get("cs-referer", default=""),
                    "${base64:JHtqbmRp" in event.deep_get("cs-referer", default=""),
                    "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$"
                    in event.deep_get("cs-referer", default=""),
                    "${${lower:j}ndi:" in event.deep_get("cs-referer", default=""),
                    "${${upper:j}ndi:" in event.deep_get("cs-referer", default=""),
                    "${${::-j}${::-n}${::-d}${::-i}:" in event.deep_get("cs-referer", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
