Attachment: File execution via Javascript

type.inbound
and any(attachments,
        .file_type in $file_extensions_common_archives
        and any(file.explode(.),
                any(.scan.javascript.identifiers,
                    strings.ilike(., 'ActiveXObject', 'ShellExecute')
                )
                or (
                  length(.scan.javascript.strings) > 0
                  and all(.scan.javascript.strings,
                          strings.ilike(., 'Shell.Application', '*.exe')
                  )
                )
        )
)