Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

type.inbound
and any(filter(attachments,
               .file_type == "pdf"
               // creator and producer of PDF seen in malicious content
               and (
                 strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                 or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
               )
        ),
        any(filter(file.explode(.), .scan.ocr.raw is not null),
            (
              any(ml.nlu_classifier(.scan.ocr.raw).intents,
                  .name in ('cred_theft', 'bec') and .confidence != 'low'
              )
            )
        )
        // suspicious link
        and any(file.explode(.),
                any(.scan.pdf.urls,
                    // short 1 char path
                    length(.path) == 2
                    // oauth redirect
                    or (
                      strings.istarts_with(.path, '/oauth/')
                      and strings.icontains(.query_params, 'redirect_uri=')
                    )
                    // short 1 char path in redirect
                    or any(.query_params_decoded['redirect'],
                           length(strings.parse_url(.).path) == 2
                    )
                    // url param conatins recipeint domain
                    or any(.query_params_decoded['url'],
                           strings.contains(strings.parse_url(.).path,
                                            recipients.to[0].email.domain.sld
                           )
                    )
                    // multiple redirectUrl query_parms
                    or length(.query_params_decoded['redirectUrl']) > 1
                )
        )
)