def rule(event):
    if all(
        [
            "~1" in event.deep_get("cs-uri-query", default=""),
            event.deep_get("cs-uri-query", default="").endswith("a.aspx"),
            event.deep_get("cs-method", default="") in ["GET", "OPTIONS"],
            event.deep_get("sc-status", default="") in [200, 301],
        ]
    ):
        return True
    return False
