Attachment: Base64 encoded bash command in filename

type.inbound
and length(attachments) > 0
and any(attachments,
        (
          .file_type in $file_extensions_common_archives
          or strings.contains(.file_name, "{")
        )
        and any(file.expand_archives(.).files,
                strings.contains(.file_name, "{")
                and (
                  strings.icontains(.file_name, 'echo,')
                  or strings.icontains(.file_name, 'base64')
                  or regex.icontains(.file_name, '\bbash\b')
                  or any(beta.scan_base64(.file_name, ignore_padding=true),
                         length(.) >= 10
                  )
                )
        )
)