def rule(event):
    if all(
        [
            any(
                [
                    event.deep_get("host", default="").endswith(".bid"),
                    event.deep_get("host", default="").endswith(".by"),
                    event.deep_get("host", default="").endswith(".cf"),
                    event.deep_get("host", default="").endswith(".click"),
                    event.deep_get("host", default="").endswith(".cm"),
                    event.deep_get("host", default="").endswith(".ga"),
                    event.deep_get("host", default="").endswith(".gq"),
                    event.deep_get("host", default="").endswith(".ir"),
                    event.deep_get("host", default="").endswith(".kp"),
                    event.deep_get("host", default="").endswith(".loan"),
                    event.deep_get("host", default="").endswith(".ml"),
                    event.deep_get("host", default="").endswith(".mm"),
                    event.deep_get("host", default="").endswith(".party"),
                    event.deep_get("host", default="").endswith(".pw"),
                    event.deep_get("host", default="").endswith(".ru"),
                    event.deep_get("host", default="").endswith(".su"),
                    event.deep_get("host", default="").endswith(".sy"),
                    event.deep_get("host", default="").endswith(".tk"),
                    event.deep_get("host", default="").endswith(".top"),
                    event.deep_get("host", default="").endswith(".tv"),
                    event.deep_get("host", default="").endswith(".ve"),
                    event.deep_get("host", default="").endswith(".work"),
                    event.deep_get("host", default="").endswith(".xyz"),
                ]
            ),
            any(
                [
                    any(
                        [
                            event.deep_get("uri", default="").endswith(".bat"),
                            event.deep_get("uri", default="").endswith(".bin"),
                            event.deep_get("uri", default="").endswith(".cmd"),
                            event.deep_get("uri", default="").endswith(".cpl"),
                            event.deep_get("uri", default="").endswith(".dll"),
                            event.deep_get("uri", default="").endswith(".dylib"),
                            event.deep_get("uri", default="").endswith(".elf"),
                            event.deep_get("uri", default="").endswith(".exe"),
                            event.deep_get("uri", default="").endswith(".hta"),
                            event.deep_get("uri", default="").endswith(".iso"),
                            event.deep_get("uri", default="").endswith(".jar"),
                            event.deep_get("uri", default="").endswith(".js"),
                            event.deep_get("uri", default="").endswith(".lnk"),
                            event.deep_get("uri", default="").endswith(".msi"),
                            event.deep_get("uri", default="").endswith(".pif"),
                            event.deep_get("uri", default="").endswith(".ps1"),
                            event.deep_get("uri", default="").endswith(".py"),
                            event.deep_get("uri", default="").endswith(".reg"),
                            event.deep_get("uri", default="").endswith(".scr"),
                            event.deep_get("uri", default="").endswith(".sh"),
                            event.deep_get("uri", default="").endswith(".so"),
                            event.deep_get("uri", default="").endswith(".vbs"),
                            event.deep_get("uri", default="").endswith(".wsf"),
                        ]
                    ),
                    event.deep_get("resp_mime_types", default="")
                    in [
                        "application/vnd.microsoft.portable-executable",
                        "application/x-bat",
                        "application/x-dosexec",
                        "application/x-elf",
                        "application/x-iso9660-image",
                        "application/x-java-archive",
                        "application/x-ms-shortcut",
                        "application/x-msdos-program",
                        "application/x-msdownload",
                        "application/x-python-code",
                        "application/x-sh",
                    ],
                ]
            ),
        ]
    ):
        return True
    return False
