Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK

type.inbound
and any(attachments,
        (.file_type == "rtf" or .file_extension in $file_extensions_macros)
        and any(file.explode(.),
                any(.scan.yara.matches,
                    strings.starts_with(.name, "ShellExplorer1_LNK_")
                )
        )
)