Attachment: Malicious OneNote Commands

type.inbound
and any(attachments,
        (.file_extension in~ ("one") or .file_extension in~ $file_extensions_common_archives)
        and any(file.explode(.),
                "onenote_file" in .flavors.yara
                and any(.scan.strings.strings,
                        strings.ilike(.,
                                      "*WshShell*",
                                      "*ExecuteCmdAsync*",
                                      "*CreateObject*",
                                      "*Wscript.Shell*",
                                      "*schtasks*",
                                      "*CreateProcess*",
                                      "*winmgmts*",
                                      "*SetEnvironmentVariable*",
                                      "*powershell*",
                                      "*echo off*"
                        )
                )
        )
)