Attachment: RFP/RFQ impersonating government entities

type.inbound
and length(attachments) == 1
and all(attachments,
        .file_extension in~ $file_extensions_macros or .file_type == "pdf"
)
and regex.icontains(body.current_thread.text, "department of
| office of")
and (
  regex.icontains(subject.subject,
                  '(request for (purchase
| quot(e
| ation))
| \bRFQ\b
| \bRFP\b)'
  )
  or any(attachments,
         regex.icontains(.file_name,
                         '(request for (purchase
| quot(e
| ation))
| \bRFQ\b
| \bRFP\b)'
         )
  )
)
and strings.icontains(sender.email.domain.domain, "gov")
and (
  any(ml.nlu_classifier(body.current_thread.text).tags,
      .name == "purchase_order"
  )
  and any(attachments,
          any(file.explode(.),
              any(ml.nlu_classifier(.scan.ocr.raw).entities,
                  regex.icontains(.text, "department of
| office of")
              )
          )
  )
)