def rule(event):
    if all(
        [
            any(
                [
                    ".githubusercontent.com" in event.deep_get("Contents", default=""),
                    "anonfiles.com" in event.deep_get("Contents", default=""),
                    "cdn.discordapp.com" in event.deep_get("Contents", default=""),
                    "ddns.net" in event.deep_get("Contents", default=""),
                    "dl.dropboxusercontent.com" in event.deep_get("Contents", default=""),
                    "ghostbin.co" in event.deep_get("Contents", default=""),
                    "github.com" in event.deep_get("Contents", default=""),
                    "glitch.me" in event.deep_get("Contents", default=""),
                    "gofile.io" in event.deep_get("Contents", default=""),
                    "hastebin.com" in event.deep_get("Contents", default=""),
                    "mediafire.com" in event.deep_get("Contents", default=""),
                    "mega.nz" in event.deep_get("Contents", default=""),
                    "onrender.com" in event.deep_get("Contents", default=""),
                    "pages.dev" in event.deep_get("Contents", default=""),
                    "paste.ee" in event.deep_get("Contents", default=""),
                    "pastebin.com" in event.deep_get("Contents", default=""),
                    "pastebin.pl" in event.deep_get("Contents", default=""),
                    "pastetext.net" in event.deep_get("Contents", default=""),
                    "pixeldrain.com" in event.deep_get("Contents", default=""),
                    "privatlab.com" in event.deep_get("Contents", default=""),
                    "privatlab.net" in event.deep_get("Contents", default=""),
                    "send.exploit.in" in event.deep_get("Contents", default=""),
                    "sendspace.com" in event.deep_get("Contents", default=""),
                    "storage.googleapis.com" in event.deep_get("Contents", default=""),
                    "storjshare.io" in event.deep_get("Contents", default=""),
                    "supabase.co" in event.deep_get("Contents", default=""),
                    "temp.sh" in event.deep_get("Contents", default=""),
                    "transfer.sh" in event.deep_get("Contents", default=""),
                    "trycloudflare.com" in event.deep_get("Contents", default=""),
                    "ufile.io" in event.deep_get("Contents", default=""),
                    "w3spaces.com" in event.deep_get("Contents", default=""),
                    "workers.dev" in event.deep_get("Contents", default=""),
                ]
            ),
            any(
                [
                    ".cpl:Zone" in event.deep_get("TargetFilename", default=""),
                    ".dll:Zone" in event.deep_get("TargetFilename", default=""),
                    ".exe:Zone" in event.deep_get("TargetFilename", default=""),
                    ".hta:Zone" in event.deep_get("TargetFilename", default=""),
                    ".lnk:Zone" in event.deep_get("TargetFilename", default=""),
                    ".one:Zone" in event.deep_get("TargetFilename", default=""),
                    ".vbe:Zone" in event.deep_get("TargetFilename", default=""),
                    ".vbs:Zone" in event.deep_get("TargetFilename", default=""),
                    ".xll:Zone" in event.deep_get("TargetFilename", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
