Attachment: LNK with embedded content

type.inbound
and (
  any(attachments,
      .file_extension == "lnk"
      and any(file.explode(.),
              .file_extension =~ "lnk"
              and any(.scan.exiftool.fields, (.key == "TargetFileSize" and .value == "0"))
              and any(.scan.exiftool.fields,
                      (
                        .key == "CommandLineArguments"
                        and strings.ilike(.value, "*findstr*", "*sc $path*", "*Set-Content*")
                      )
              )
      )
  )
)