Attachment: Office document loads remote document template

type.inbound
and any(attachments,
        (
          (
            // office files
            .file_extension in~ $file_extensions_macros
            or .file_extension in~ $file_extensions_common_archives
            or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
            )
          )
          and any(file.explode(.),
                  .flavors.mime == "text/xml"
                  and any(.scan.strings.strings,
                          regex.icontains(., "Target.{0,20}http.{0,200}dotm")
                  )
          )
        )
)