type.inbound
and length(filter(attachments, .file_type == "pdf")) == 1
and any(regex.extract(body.current_thread.text, 'password is (?P<pw>[0-9]{1,})'),
any(filter(attachments, .file_type == "pdf"),
strings.contains(.file_name, ..named_groups["pw"])
)
)
Playground
Test against your own EMLs or sample data.