Attachment: PDF with credential theft language and invalid reply-to domain

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(headers.reply_to, .email.email == "")
and any(attachments,
        .file_type == 'pdf'
        and any(file.explode(.),
                any(ml.nlu_classifier(.scan.strings.raw).intents,
                    .name == 'cred_theft' and .confidence == 'high'
                )
                and strings.icontains(.scan.strings.raw,
                                      recipients.to[0].email.email
                )
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)