Manually append query string using Url Rewrite in IIS

I'm trying to create a rewrite rule such as:

~/company_search.aspx?cat=987&page=2&loc=1234

to

~/company_category/987/estiatoria/?loc=1234&page=2

My rewrite rule is:

<rule name="Company Category">
<match url="company_category/([0-9]+)/(?:[^/]*)/?" />
<action type="Rewrite" url="company_search.aspx?cat={R:1}" appendQueryString="true" />
</rule>

The part /estiatoria/ in the sample rewritten url is optional for seo optimization and not specified in the actual querystring neither has any other use. When I do a postback I get the cat parameter 2 times with a value 987,987 and my server-side code gets messed up.

So I tried to manually append the querystring in order to exclude the cat parameter and append all the others. So I changed the rule to:

<rule name="Company Category">
<match url="company_category/([0-9]+)/(?:[^/]*)/?(?:\?|&amp;)?(.*)" />
<action type="Rewrite" url="company_search.aspx?cat={R:1}&amp;{R:2}" appendQueryString="false" />
</rule>

But I don't get any other values in the querystring except cat. Am I doing something wrong?

Update:

I think I must add a querystring condition in order to exclude the cat parameter and then append the rest matching result. So for the querystring:

?cat=987&page=2&loc=1234

I'd like to get:

?page=2&loc=1234

and the cat parameter could be in any order or not present.

I tried:

<rule name="Company Categories Search">
<match url="company_category/([0-9]+)/(?:[^/]*)/?" />
<conditions>
    <add input="{QUERY_STRING}" pattern="(?!cat=[0-9]+)(.*)(cat=[0-9]+|$)(?!cat=[0-9]+)(.*)" />
</conditions>
<action type="Rewrite" url="company_search.aspx?cat={R:1}&amp;{C:1}&amp;{C:3}" appendQueryString="false" />
</rule>

When I hit the url:

~/company_category/987/estiatoria/?page=2&loc=1234

I get on the server side Request.Querystring the following value:

cat=987&page=2&loc=1234&

but when I do a postback I get:

cat=987&at=987&page=2&loc=1234&

Can someone please help me with that last regex condition?

Update 2:

I've come to a solution but it doesn't cover every scenario:

<rule name="Company Categories Search">
<match url="company_category/([0-9]+)/(?:[^/]*)/?" />
<conditions logicalGrouping="MatchAny">
    <add input="{QUERY_STRING}" pattern="(cat=[0-9]+)(.*)" />
    <add input="{QUERY_STRING}" pattern="(^)(.*)" />
</conditions>
<action type="Rewrite" url="company_search.aspx?cat={R:1}&amp;{C:2}" appendQueryString="false" />
</rule>

I've used 2 condition rules with MatchAny option in order to match one: the query string when the cat value is present in the mapped url (currently only in postbacks) and two: when it's not present.

If the cat parameter is somehow between page and loc parameters the previous parameter is not included in the query string. If anyone has a better solution please let me know.