import json


def rule(event):
    if all(
        [
            "pkexec" in json.dumps(event.to_dict()),
            "The value for environment variable XAUTHORITY contains suspicious content"
            in json.dumps(event.to_dict()),
            "[USER=root] [TTY=/dev/pts/0]" in json.dumps(event.to_dict()),
        ]
    ):
        return True
    return False
