Attachment: HTML smuggling with excessive string concatenation and suspicious patterns

type.inbound
and any(attachments,
        // HTML file, or something like it
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml")
          or (
            .file_extension is null
            and .file_type == "unknown"
            and .content_type == "application/octet-stream"
            and .size < 100000000
          )
          or .file_type == "html"
        )

        // small HTML file
        and .size < 5000

        // lots of concatenation (obfuscation technique)
        and strings.count(file.parse_html(.).raw, "+") > 20

        // contains a recipient's email address
        and any(recipients.to,
                strings.icontains(file.parse_html(..).raw, .email.email)
                and .email.domain.valid
        )

        // HTML smuggling
        and 1 of (
          strings.ilike(file.parse_html(.).raw, "*window.location.href*"),
          strings.ilike(file.parse_html(.).raw, "*createObjectURL*")
        )
)