import json


def rule(event):
    if "bpf_probe_write_user" in json.dumps(event.to_dict()):
        return True
    return False
