Attachment: EML with Encrypted ZIP

type.inbound
// attached EML
and any(filter(attachments, .content_type == "message/rfc822" or .file_extension in ('eml')),
        // Attached EML contains a ZIP file
        any(filter(file.parse_eml(.).attachments,
                   .file_type == "zip" or .file_extension == "zip"
            ),
            // ZIP file is encrypted
            any(file.explode(.),
                any(.flavors.yara, . == 'encrypted_zip') or .scan.zip.encrypted
            )
        )
)