def rule(event):
    if all(
        [
            event.deep_get("c-uri-extension", default="")
            in [
                "exe",
                "vbs",
                "bat",
                "rar",
                "ps1",
                "doc",
                "docm",
                "xls",
                "xlsm",
                "pptm",
                "rtf",
                "hta",
                "dll",
                "ws",
                "wsf",
                "sct",
                "zip",
            ],
            any(
                [
                    event.deep_get("cs-host", default="").endswith(".country"),
                    event.deep_get("cs-host", default="").endswith(".stream"),
                    event.deep_get("cs-host", default="").endswith(".gdn"),
                    event.deep_get("cs-host", default="").endswith(".mom"),
                    event.deep_get("cs-host", default="").endswith(".xin"),
                    event.deep_get("cs-host", default="").endswith(".kim"),
                    event.deep_get("cs-host", default="").endswith(".men"),
                    event.deep_get("cs-host", default="").endswith(".loan"),
                    event.deep_get("cs-host", default="").endswith(".download"),
                    event.deep_get("cs-host", default="").endswith(".racing"),
                    event.deep_get("cs-host", default="").endswith(".online"),
                    event.deep_get("cs-host", default="").endswith(".science"),
                    event.deep_get("cs-host", default="").endswith(".ren"),
                    event.deep_get("cs-host", default="").endswith(".gb"),
                    event.deep_get("cs-host", default="").endswith(".win"),
                    event.deep_get("cs-host", default="").endswith(".top"),
                    event.deep_get("cs-host", default="").endswith(".review"),
                    event.deep_get("cs-host", default="").endswith(".vip"),
                    event.deep_get("cs-host", default="").endswith(".party"),
                    event.deep_get("cs-host", default="").endswith(".tech"),
                    event.deep_get("cs-host", default="").endswith(".xyz"),
                    event.deep_get("cs-host", default="").endswith(".date"),
                    event.deep_get("cs-host", default="").endswith(".faith"),
                    event.deep_get("cs-host", default="").endswith(".zip"),
                    event.deep_get("cs-host", default="").endswith(".cricket"),
                    event.deep_get("cs-host", default="").endswith(".space"),
                    event.deep_get("cs-host", default="").endswith(".info"),
                    event.deep_get("cs-host", default="").endswith(".vn"),
                    event.deep_get("cs-host", default="").endswith(".cm"),
                    event.deep_get("cs-host", default="").endswith(".am"),
                    event.deep_get("cs-host", default="").endswith(".cc"),
                    event.deep_get("cs-host", default="").endswith(".asia"),
                    event.deep_get("cs-host", default="").endswith(".ws"),
                    event.deep_get("cs-host", default="").endswith(".tk"),
                    event.deep_get("cs-host", default="").endswith(".biz"),
                    event.deep_get("cs-host", default="").endswith(".su"),
                    event.deep_get("cs-host", default="").endswith(".st"),
                    event.deep_get("cs-host", default="").endswith(".ro"),
                    event.deep_get("cs-host", default="").endswith(".ge"),
                    event.deep_get("cs-host", default="").endswith(".ms"),
                    event.deep_get("cs-host", default="").endswith(".pk"),
                    event.deep_get("cs-host", default="").endswith(".nu"),
                    event.deep_get("cs-host", default="").endswith(".me"),
                    event.deep_get("cs-host", default="").endswith(".ph"),
                    event.deep_get("cs-host", default="").endswith(".to"),
                    event.deep_get("cs-host", default="").endswith(".tt"),
                    event.deep_get("cs-host", default="").endswith(".name"),
                    event.deep_get("cs-host", default="").endswith(".tv"),
                    event.deep_get("cs-host", default="").endswith(".kz"),
                    event.deep_get("cs-host", default="").endswith(".tc"),
                    event.deep_get("cs-host", default="").endswith(".mobi"),
                    event.deep_get("cs-host", default="").endswith(".study"),
                    event.deep_get("cs-host", default="").endswith(".click"),
                    event.deep_get("cs-host", default="").endswith(".link"),
                    event.deep_get("cs-host", default="").endswith(".trade"),
                    event.deep_get("cs-host", default="").endswith(".accountant"),
                    event.deep_get("cs-host", default="").endswith(".cf"),
                    event.deep_get("cs-host", default="").endswith(".gq"),
                    event.deep_get("cs-host", default="").endswith(".ml"),
                    event.deep_get("cs-host", default="").endswith(".ga"),
                    event.deep_get("cs-host", default="").endswith(".pw"),
                ]
            ),
        ]
    ):
        return True
    return False
