import re


def rule(event):
    if all(
        [
            event.deep_get("Image", default="").endswith("/wget"),
            re.match(
                r"https://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
                event.deep_get("CommandLine", default=""),
            ),
            "--no-check-certificate" in event.deep_get("CommandLine", default=""),
            event.deep_get("CommandLine", default="").endswith(".tar"),
            not any(
                [
                    "https://10." in event.deep_get("CommandLine", default=""),
                    "https://192.168." in event.deep_get("CommandLine", default=""),
                    "https://172.16." in event.deep_get("CommandLine", default=""),
                    "https://172.17." in event.deep_get("CommandLine", default=""),
                    "https://172.18." in event.deep_get("CommandLine", default=""),
                    "https://172.19." in event.deep_get("CommandLine", default=""),
                    "https://172.20." in event.deep_get("CommandLine", default=""),
                    "https://172.21." in event.deep_get("CommandLine", default=""),
                    "https://172.22." in event.deep_get("CommandLine", default=""),
                    "https://172.23." in event.deep_get("CommandLine", default=""),
                    "https://172.24." in event.deep_get("CommandLine", default=""),
                    "https://172.25." in event.deep_get("CommandLine", default=""),
                    "https://172.26." in event.deep_get("CommandLine", default=""),
                    "https://172.27." in event.deep_get("CommandLine", default=""),
                    "https://172.28." in event.deep_get("CommandLine", default=""),
                    "https://172.29." in event.deep_get("CommandLine", default=""),
                    "https://172.30." in event.deep_get("CommandLine", default=""),
                    "https://172.31." in event.deep_get("CommandLine", default=""),
                    "https://127." in event.deep_get("CommandLine", default=""),
                    "https://169.254." in event.deep_get("CommandLine", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
