Attachment: Fake scan-to-email

type.inbound
and length(body.current_thread.text) < 1500
and (
  3 of (
    strings.icontains(body.current_thread.text, "Number of Images:"),
    strings.icontains(body.current_thread.text, "Attachment File Type:"),
    strings.icontains(body.current_thread.text, "Device Model:"),
    strings.icontains(body.current_thread.text, "Device Name:"),
    strings.icontains(body.current_thread.text, "Resolution:"),
    strings.icontains(body.current_thread.text, "File Format:"),
    strings.icontains(body.current_thread.text, "Device Location:")
  )
  or (
    3 of (
      strings.ilike(body.current_thread.text, "*scan date*"),
      strings.ilike(body.current_thread.text, "*was sent from*"),
      strings.ilike(body.current_thread.text, "*of pages*"),
      strings.ilike(body.current_thread.text, "*scanned file*"),
    )
    or any(file.explode(beta.message_screenshot()),
           3 of (
             strings.ilike(body.current_thread.text, "*scan date*"),
             strings.ilike(body.current_thread.text, "*was sent from*"),
             strings.ilike(body.current_thread.text, "*of pages*"),
             strings.ilike(body.current_thread.text, "*scanned file*"),
             strings.icontains(body.current_thread.text, "Number of Images:"),
             strings.icontains(body.current_thread.text,
                               "Attachment File Type:"
             ),
             strings.icontains(body.current_thread.text, "Device Name:"),
             strings.icontains(body.current_thread.text, "Device Location:"),
             strings.icontains(body.current_thread.text, "Device Model:")
           )
    )
  )
)
and length(filter(attachments, .file_type == "pdf")) == 1
and any(attachments,
        .file_type == "pdf"
        and (
          any(file.explode(.),
              (
                strings.ilike(.scan.ocr.raw,
                              "*scan date*",
                              "*was sent from*",
                              "*of pages*",
                              "*verif*document*",
                              "*scanned file*"
                )
                or any(ml.nlu_classifier(.scan.ocr.raw).intents,
                       .name == "cred_theft"
                )
                or any(ml.logo_detect(..).brands,
                       .name in ("DocuSign", "Microsoft")
                )
              )
              and length(.scan.url.urls) == 1
          )
          // encrypted pdf
          or any(file.explode(.),
                 any(.scan.exiftool.fields, .key == "Encryption")
                 or (
                   .scan.entropy.entropy > 7
                   and any(.scan.strings.strings,
                           strings.icontains(., "/Encrypt")
                   )
                 )
          )
        )
)
and sender.email.domain.domain not in~ $org_domains
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)
and not profile.by_sender().any_false_positives