Attachment: PDF with embedded Javascript

type.inbound
and any(attachments,
        .file_extension == "pdf"
        and any(file.explode(.),
                (
                  (any(.scan.strings.strings, strings.icontains(., '/JavaScript')))
                  and (any(.scan.strings.strings, strings.icontains(., '/JS (')))
                )
        )
)

and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)