Attachment: Fake PDF Invoices Yara

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                .name in (
                  "fake_invoice_pdf_structure_01",
                  "fake_invoice_pdf_images_01",
                )
            )
        )
)