Attachment: PDF bid/proposal lure with credential theft indicators

type.inbound
// only one attachment
and length(attachments) == 1
// only pdfs with one page
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(attachments, .file_type == 'pdf' and beta.parse_exif(.).page_count == 1)
// two of these...
and 2 of (
  // bid/rfp/proposal phrases commonly observed in lures which are in the display text of a url from the pdf
  any(attachments,
      any(file.explode(.),
          any(.scan.url.urls,
              regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
                              '(?:\b(?:request|review)\b.{1,5}\b(?:bid|proposal|rfp|rfq|quotation)\b|\b(?:bid|proposal|rfp|rfq|quotation)\b.{1,5}\b(?:request|review)\b)'
              )
          )
      )
  ),
  (
    // bid/rfp/proposal phrases commonly observed in lures which are in various spots in the message
    any([subject.base, sender.display_name, body.current_thread.text],
        regex.icontains(., '\b(?:bid|proposal|rfp|rfq|quotation)\b')
    )
  ),
  // bid/rfp/proposal phrases commonly observed in lures which are in the file name
  any(attachments,
      regex.icontains(.file_name, '\b(?:bid|proposal|rfp|rfq|quotation)\b')
  ),
  any(attachments,
      any(file.explode(.),
          // bid/rfp/proposal phrases commonly observed in lures which are in the ocr of the pdf
          regex.icontains(.scan.ocr.raw,
                          '(?:\b(?:request|review)\b.{1,5}\\b(?:bid|proposal|rfp|rfq|quotation)\b|\b(?:bid|proposal|rfp|rfq|quotation)\b.{1,5}\b(?:request|review)\b)'
          )
      )
  ),
  (
    any(attachments,
        any(file.explode(.),
            any(.scan.url.urls,
                // bid/rfp/proposal phrases commonly observed in lures which are in the url
                regex.icontains(.url,
                                '(?:bid|proposal|agreement|contract|settlement|RFQ|RFP|quotation)'
                )
            )
        )
    )
  )
)

// ocr indicates high confidence cred theft
and (
  any(attachments,
      any(file.explode(.),
          any(ml.nlu_classifier(.scan.ocr.raw).intents,
              .name == 'cred_theft' and .confidence == 'high'
          )
          or any(ml.nlu_classifier(.scan.ocr.raw).topics,
                 .name == 'Purchase Orders' and .confidence == 'high'
          )
      )
  )
  // message body current thread indicates high confidence cred theft
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == 'cred_theft' and .confidence == 'high'
  )
  // message body current thread indicates high confidence cred theft
  or any(ml.nlu_classifier(body.current_thread.text).topics,
         .name == 'Purchase Orders' and .confidence == 'high'
  )
)

// pdf contains some suspicious url domain
and (
  any(attachments,
      any(file.explode(.),
          any(.scan.url.urls,
              .domain.root_domain in $self_service_creation_platform_domains
              or .domain.domain in $self_service_creation_platform_domains
              or .domain.root_domain in $free_file_hosts
              or .domain.domain in $free_file_hosts
              or .domain.root_domain in $free_subdomain_hosts
              or .domain.domain in $free_subdomain_hosts
              or .domain.tld in $suspicious_tlds
              or .domain.domain in $url_shorteners
              or .domain.root_domain in $url_shorteners
          )
      )
  )
)
// we dont want emails where all the links are docusign or dotloop
and not all(body.links,
            .href_url.domain.root_domain in (
              'docusign.net',
              'docusign.com',
              'dotloop.com'
            )
)
// negating solicited senders is necessary due to the nature of the rule
and not profile.by_sender().solicited

// negate workflow robot
and not (
  sender.email.local_part == 'workflow.robot'
  and sender.email.domain.root_domain == 'effem.com'
)