Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

type.inbound
and any(filter(attachments,
               .file_type == "pdf"
               // creator and producer of PDF seen in malicious content
               and (
                 strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                 or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
               )
        ),
        any(filter(file.explode(.), .scan.ocr.raw is not null),
            (
              any(ml.nlu_classifier(.scan.ocr.raw).intents,
                  .name in ('cred_theft', 'bec') and .confidence != 'low'
              )
            )
        )
        // suspicious link
        and (
          any(file.explode(.),
              any(.scan.pdf.urls,
                  // short 1 char path
                  length(.path) == 2
                  // oauth redirect
                  or (
                    strings.istarts_with(.path, '/oauth/')
                    and strings.icontains(.query_params, 'redirect_uri=')
                  )
                  // short 1 char path in redirect
                  or any(.query_params_decoded['redirect'],
                         length(strings.parse_url(.).path) == 2
                  )
                  // url param conatins recipeint domain
                  or any(.query_params_decoded['url'],
                         strings.contains(strings.parse_url(.).path,
                                          recipients.to[0].email.domain.sld
                         )
                  )
                  // multiple redirectUrl query_parms
                  or length(.query_params_decoded['redirectUrl']) > 1
              )
          )
          // sendgrid link, only on single-page PDFs
          or (
            beta.parse_exif(.).page_count == 1
            and any(file.explode(.),
                    any(.scan.pdf.urls,
                        strings.iends_with(.domain.domain, 'ct.sendgrid.net')
                        and .path == '/ls/click'
                    )
            )
          )
        )
)