Attachment: File execution via Javascript

type.inbound
and any(attachments,
        .file_type in $file_extensions_common_archives
        and any(file.explode(.),
                any(.scan.javascript.identifiers, strings.ilike(., 'ActiveXObject', 'ShellExecute'))
                or (
                  length(.scan.javascript.strings) > 0
                  and all(.scan.javascript.strings, strings.ilike(., 'Shell.Application', '*.exe'))
                )
        )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_false_positives