def rule(event):
    if all(
        [
            "/" in event.deep_get("c-uri", default=""),
            ".php\\?l=" in event.deep_get("c-uri", default=""),
            event.deep_get("c-uri", default="").endswith(".cab"),
            event.deep_get("sc-status", default="") == 200,
        ]
    ):
        return True
    return False
