Attachment: Excel file with hyperlinks to suspicious domains

type.inbound
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ('bec', 'cred_theft') and .confidence != 'low'
  )
  or strings.icontains(body.current_thread.text, 'your review', 'please review')
)
and any(attachments,
        .file_extension in~ ("xls")
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.parse_exif(.).fields,
                .key == "Hyperlinks"
                and any(strings.parse_json(.value),
                        (
                          strings.parse_url(.).domain.domain in $free_subdomain_hosts
                          or strings.parse_url(.).domain.root_domain in $free_file_hosts
                          or strings.parse_url(.).domain.tld in $suspicious_tlds
                          or strings.parse_url(.).domain.root_domain in $url_shorteners
                          or strings.parse_url(.).domain.domain in $url_shorteners
                        )
                )
        )
)