Attachment: PowerPoint with suspicious hyperlink

type.inbound
and any(attachments,
        (.file_extension in~ ("ppt", "pptx"))
        and any(file.explode(.),
                any(.scan.exiftool.fields,
                    .key == "Hyperlinks"
                    and (
                      4 of (
                        strings.ilike(.value, "*[Convert]::ToChar*"),
                        strings.ilike(.value, "*vbs*"),
                        strings.ilike(.value, "*[IO.File]::Create*"),
                        strings.ilike(.value, "*[IO.File]::Exists*"),
                        strings.ilike(.value,
                                      "*[io.FileOPtions]::DeleteOnClose*"
                        ),
                        strings.ilike(.value, "*Net.WebClient*"),
                        strings.ilike(.value, "*dll*"),
                      )
                    )
                )
        )
)