def rule(event):
    if all(
        [
            event.deep_get("c-uri-extension", default="")
            in [
                "exe",
                "vbs",
                "bat",
                "rar",
                "ps1",
                "doc",
                "docm",
                "xls",
                "xlsm",
                "pptm",
                "rtf",
                "hta",
                "dll",
                "ws",
                "wsf",
                "sct",
                "zip",
            ],
            any(
                [
                    event.deep_get("cs-host", default="").endswith(".hopto.org"),
                    event.deep_get("cs-host", default="").endswith(".no-ip.org"),
                    event.deep_get("cs-host", default="").endswith(".no-ip.info"),
                    event.deep_get("cs-host", default="").endswith(".no-ip.biz"),
                    event.deep_get("cs-host", default="").endswith(".no-ip.com"),
                    event.deep_get("cs-host", default="").endswith(".noip.com"),
                    event.deep_get("cs-host", default="").endswith(".ddns.name"),
                    event.deep_get("cs-host", default="").endswith(".myftp.org"),
                    event.deep_get("cs-host", default="").endswith(".myftp.biz"),
                    event.deep_get("cs-host", default="").endswith(".serveblog.net"),
                    event.deep_get("cs-host", default="").endswith(".servebeer.com"),
                    event.deep_get("cs-host", default="").endswith(".servemp3.com"),
                    event.deep_get("cs-host", default="").endswith(".serveftp.com"),
                    event.deep_get("cs-host", default="").endswith(".servequake.com"),
                    event.deep_get("cs-host", default="").endswith(".servehalflife.com"),
                    event.deep_get("cs-host", default="").endswith(".servehttp.com"),
                    event.deep_get("cs-host", default="").endswith(".servegame.com"),
                    event.deep_get("cs-host", default="").endswith(".servepics.com"),
                    event.deep_get("cs-host", default="").endswith(".myvnc.com"),
                    event.deep_get("cs-host", default="").endswith(".ignorelist.com"),
                    event.deep_get("cs-host", default="").endswith(".jkub.com"),
                    event.deep_get("cs-host", default="").endswith(".dlinkddns.com"),
                    event.deep_get("cs-host", default="").endswith(".jumpingcrab.com"),
                    event.deep_get("cs-host", default="").endswith(".ddns.info"),
                    event.deep_get("cs-host", default="").endswith(".mooo.com"),
                    event.deep_get("cs-host", default="").endswith(".dns-dns.com"),
                    event.deep_get("cs-host", default="").endswith(".strangled.net"),
                    event.deep_get("cs-host", default="").endswith(".adultdns.net"),
                    event.deep_get("cs-host", default="").endswith(".craftx.biz"),
                    event.deep_get("cs-host", default="").endswith(".ddns01.com"),
                    event.deep_get("cs-host", default="").endswith(".dns53.biz"),
                    event.deep_get("cs-host", default="").endswith(".dnsapi.info"),
                    event.deep_get("cs-host", default="").endswith(".dnsd.info"),
                    event.deep_get("cs-host", default="").endswith(".dnsdynamic.com"),
                    event.deep_get("cs-host", default="").endswith(".dnsdynamic.net"),
                    event.deep_get("cs-host", default="").endswith(".dnsget.org"),
                    event.deep_get("cs-host", default="").endswith(".fe100.net"),
                    event.deep_get("cs-host", default="").endswith(".flashserv.net"),
                    event.deep_get("cs-host", default="").endswith(".ftp21.net"),
                    event.deep_get("cs-host", default="").endswith(".http01.com"),
                    event.deep_get("cs-host", default="").endswith(".http80.info"),
                    event.deep_get("cs-host", default="").endswith(".https443.com"),
                    event.deep_get("cs-host", default="").endswith(".imap01.com"),
                    event.deep_get("cs-host", default="").endswith(".kadm5.com"),
                    event.deep_get("cs-host", default="").endswith(".mysq1.net"),
                    event.deep_get("cs-host", default="").endswith(".ns360.info"),
                    event.deep_get("cs-host", default="").endswith(".ntdll.net"),
                    event.deep_get("cs-host", default="").endswith(".ole32.com"),
                    event.deep_get("cs-host", default="").endswith(".proxy8080.com"),
                    event.deep_get("cs-host", default="").endswith(".sql01.com"),
                    event.deep_get("cs-host", default="").endswith(".ssh01.com"),
                    event.deep_get("cs-host", default="").endswith(".ssh22.net"),
                    event.deep_get("cs-host", default="").endswith(".tempors.com"),
                    event.deep_get("cs-host", default="").endswith(".tftpd.net"),
                    event.deep_get("cs-host", default="").endswith(".ttl60.com"),
                    event.deep_get("cs-host", default="").endswith(".ttl60.org"),
                    event.deep_get("cs-host", default="").endswith(".user32.com"),
                    event.deep_get("cs-host", default="").endswith(".voip01.com"),
                    event.deep_get("cs-host", default="").endswith(".wow64.net"),
                    event.deep_get("cs-host", default="").endswith(".x64.me"),
                    event.deep_get("cs-host", default="").endswith(".xns01.com"),
                    event.deep_get("cs-host", default="").endswith(".dyndns.org"),
                    event.deep_get("cs-host", default="").endswith(".dyndns.info"),
                    event.deep_get("cs-host", default="").endswith(".dyndns.tv"),
                    event.deep_get("cs-host", default="").endswith(".dyndns-at-home.com"),
                    event.deep_get("cs-host", default="").endswith(".dnsomatic.com"),
                    event.deep_get("cs-host", default="").endswith(".zapto.org"),
                    event.deep_get("cs-host", default="").endswith(".webhop.net"),
                    event.deep_get("cs-host", default="").endswith(".25u.com"),
                    event.deep_get("cs-host", default="").endswith(".slyip.net"),
                ]
            ),
        ]
    ):
        return True
    return False
