Attachment: PDF with suspicious HeadlessChrome metadata

type.inbound
and any(filter(attachments, .file_extension == "pdf"),
        strings.icontains(beta.parse_exif(.).creator, "HeadlessChrome")
        and beta.parse_exif(.).page_count == 1
        and (
          // MD5 filename, 32 hex chars and .html
          regex.imatch(beta.parse_exif(.).title, '^[a-f0-9]{32}\.html$')
          or 
          // about:blank and Windows HeadlessChrome 
          (
            beta.parse_exif(.).title == "about:blank"
            and strings.istarts_with(beta.parse_exif(.).producer, "Skia/PDF")
            and strings.icontains(beta.parse_exif(.).creator, "Windows")
          )
        )
        and not strings.icontains(beta.parse_exif(.).producer, "Google Docs")
)
and not (
  sender.email.domain.root_domain in (
    "guardtek.net",
    "gominis.com",
    "aglgroup.com",
    "truckerzoom.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)