import re


def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("Image", default="").endswith("\\wget.exe"),
                    event.deep_get("OriginalFileName", default="") == "wget.exe",
                ]
            ),
            re.match(
                r"://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
                event.deep_get("CommandLine", default=""),
            ),
            "http" in event.deep_get("CommandLine", default=""),
            any(
                [
                    re.match(r"\\s-O\\s", event.deep_get("CommandLine", default="")),
                    "--output-document" in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    event.deep_get("CommandLine", default="").endswith(".ps1"),
                    event.deep_get("CommandLine", default="").endswith(".ps1'"),
                    event.deep_get("CommandLine", default="").endswith('.ps1"'),
                    event.deep_get("CommandLine", default="").endswith(".dat"),
                    event.deep_get("CommandLine", default="").endswith(".dat'"),
                    event.deep_get("CommandLine", default="").endswith('.dat"'),
                    event.deep_get("CommandLine", default="").endswith(".msi"),
                    event.deep_get("CommandLine", default="").endswith(".msi'"),
                    event.deep_get("CommandLine", default="").endswith('.msi"'),
                    event.deep_get("CommandLine", default="").endswith(".bat"),
                    event.deep_get("CommandLine", default="").endswith(".bat'"),
                    event.deep_get("CommandLine", default="").endswith('.bat"'),
                    event.deep_get("CommandLine", default="").endswith(".exe"),
                    event.deep_get("CommandLine", default="").endswith(".exe'"),
                    event.deep_get("CommandLine", default="").endswith('.exe"'),
                    event.deep_get("CommandLine", default="").endswith(".vbs"),
                    event.deep_get("CommandLine", default="").endswith(".vbs'"),
                    event.deep_get("CommandLine", default="").endswith('.vbs"'),
                    event.deep_get("CommandLine", default="").endswith(".vbe"),
                    event.deep_get("CommandLine", default="").endswith(".vbe'"),
                    event.deep_get("CommandLine", default="").endswith('.vbe"'),
                    event.deep_get("CommandLine", default="").endswith(".hta"),
                    event.deep_get("CommandLine", default="").endswith(".hta'"),
                    event.deep_get("CommandLine", default="").endswith('.hta"'),
                    event.deep_get("CommandLine", default="").endswith(".dll"),
                    event.deep_get("CommandLine", default="").endswith(".dll'"),
                    event.deep_get("CommandLine", default="").endswith('.dll"'),
                    event.deep_get("CommandLine", default="").endswith(".psm1"),
                    event.deep_get("CommandLine", default="").endswith(".psm1'"),
                    event.deep_get("CommandLine", default="").endswith('.psm1"'),
                ]
            ),
        ]
    ):
        return True
    return False
