def rule(event):
    if all(
        [
            event.deep_get("c-uri-extension", default="")
            in [
                "exe",
                "vbs",
                "bat",
                "rar",
                "ps1",
                "doc",
                "docm",
                "xls",
                "xlsm",
                "pptm",
                "rtf",
                "hta",
                "dll",
                "ws",
                "wsf",
                "sct",
                "zip",
            ],
            not any(
                [
                    event.deep_get("cs-host", default="").endswith(".com"),
                    event.deep_get("cs-host", default="").endswith(".org"),
                    event.deep_get("cs-host", default="").endswith(".net"),
                    event.deep_get("cs-host", default="").endswith(".edu"),
                    event.deep_get("cs-host", default="").endswith(".gov"),
                    event.deep_get("cs-host", default="").endswith(".uk"),
                    event.deep_get("cs-host", default="").endswith(".ca"),
                    event.deep_get("cs-host", default="").endswith(".de"),
                    event.deep_get("cs-host", default="").endswith(".jp"),
                    event.deep_get("cs-host", default="").endswith(".fr"),
                    event.deep_get("cs-host", default="").endswith(".au"),
                    event.deep_get("cs-host", default="").endswith(".us"),
                    event.deep_get("cs-host", default="").endswith(".ch"),
                    event.deep_get("cs-host", default="").endswith(".it"),
                    event.deep_get("cs-host", default="").endswith(".nl"),
                    event.deep_get("cs-host", default="").endswith(".se"),
                    event.deep_get("cs-host", default="").endswith(".no"),
                    event.deep_get("cs-host", default="").endswith(".es"),
                ]
            ),
        ]
    ):
        return True
    return False
