Attachment: Fictitious invoice using LinkedIn's address

type.inbound
and 0 < length(filter(attachments, .file_type == "pdf")) < 3
and any(filter(attachments,
               .file_type == "pdf"
               // creator and producer of PDF seen in malicious content
               and (
                 strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                 or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
               )
        ),
        any(filter(file.explode(.), .scan.ocr.raw is not null),
            // contains LinkedIn HQ address but not from LinkedIn
            (
              strings.icontains(.scan.ocr.raw, "1000 W Maude Ave")
              and not strings.icontains(.scan.ocr.raw, "linkedin")
            )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Financial Communications" and .confidence != "low"
)