Attachment: LNK with embedded content

type.inbound
and (
  any(attachments,
      .file_extension == "lnk"
      and any(file.explode(.),
              .file_extension =~ "lnk"
              and any(.scan.exiftool.fields,
                      (.key == "TargetFileSize" and .value == "0")
              )
              and any(.scan.exiftool.fields,
                      (
                        .key == "CommandLineArguments"
                        and strings.ilike(.value,
                                          "*findstr*",
                                          "*sc $path*",
                                          "*Set-Content*"
                        )
                      )
              )
      )
  )
)