Attachment: GZ archive with credential theft content

type.inbound
and any(filter(attachments, .file_type == "gz"),
        // archive contains an email or an html payload
        any(file.explode(.),
            any(.flavors.yara, . in ("email_file", "html_file"))
        )
        and (
          // well-formed inner eml, NLU on parsed body
          any(file.expand_archives(.).files,
              any(ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).intents,
                  .name == "cred_theft" and .confidence == "high"
              )
          )
          // malformed inner eml, byte-scan html + link_analysis
          or any(filter(file.explode(.), any(.flavors.yara, . == "html_file")),
                 any(html.xpath(strings.parse_html(.scan.strings.raw),
                                '//a/@href'
                     ).nodes,
                     any(ml.nlu_classifier(ml.link_analysis(strings.parse_url(.raw
                                                            )
                                           ).final_dom.inner_text
                         ).intents,
                         .name == "cred_theft" and .confidence == "high"
                     )
                 )
          )
        )
)