def rule(event):
    if any(
        [
            "../../../../../lib/password" in event.deep_get("cs-uri-query", default=""),
            "../../../../windows/" in event.deep_get("cs-uri-query", default=""),
            "../../../etc/" in event.deep_get("cs-uri-query", default=""),
            "..%252f..%252f..%252fetc%252f" in event.deep_get("cs-uri-query", default=""),
            "..%c0%af..%c0%af..%c0%afetc%c0%af" in event.deep_get("cs-uri-query", default=""),
            "%252e%252e%252fetc%252f" in event.deep_get("cs-uri-query", default=""),
        ]
    ):
        return True
    return False
