import re


def rule(event):
    if all(
        [
            any(
                [
                    "Invoke-WebRequest" in event.deep_get("CommandLine", default=""),
                    "iwr " in event.deep_get("CommandLine", default=""),
                    "Invoke-RestMethod" in event.deep_get("CommandLine", default=""),
                    "irm " in event.deep_get("CommandLine", default=""),
                    "wget " in event.deep_get("CommandLine", default=""),
                    "curl " in event.deep_get("CommandLine", default=""),
                    "DownloadFile" in event.deep_get("CommandLine", default=""),
                    "DownloadString" in event.deep_get("CommandLine", default=""),
                ]
            ),
            any(
                [
                    any(
                        [
                            " 0x" in event.deep_get("CommandLine", default=""),
                            "//0x" in event.deep_get("CommandLine", default=""),
                            ".0x" in event.deep_get("CommandLine", default=""),
                            ".00x" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    all(
                        [
                            "http://%" in event.deep_get("CommandLine", default=""),
                            "%2e" in event.deep_get("CommandLine", default=""),
                        ]
                    ),
                    any(
                        [
                            re.match(
                                r"https?://[0-9]{1,3}\\.[0-9]{1,3}\\.0[0-9]{3,4}",
                                event.deep_get("CommandLine", default=""),
                            ),
                            re.match(
                                r"https?://[0-9]{1,3}\\.0[0-9]{3,7}",
                                event.deep_get("CommandLine", default=""),
                            ),
                            re.match(
                                r"https?://0[0-9]{3,11}", event.deep_get("CommandLine", default="")
                            ),
                            re.match(
                                r"https?://(?:0[0-9]{1,11}\\.){3}0[0-9]{1,11}",
                                event.deep_get("CommandLine", default=""),
                            ),
                            re.match(
                                r"https?://0[0-9]{1,11}", event.deep_get("CommandLine", default="")
                            ),
                            re.match(r" [0-7]{7,13}", event.deep_get("CommandLine", default="")),
                        ]
                    ),
                ]
            ),
            not re.match(
                r"https?://(?:(?:25[0-5]|(?:2[0-4]|1\\d|[1-9])?\\d)(?:\\.|\\b)){4}",
                event.deep_get("CommandLine", default=""),
            ),
        ]
    ):
        return True
    return False
