Attachment: QR code with suspicious URL patterns in EML file

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(attachments,
        // Email Attachments
        any(file.parse_eml(.).attachments,
            (
              // looks for office docs in the attached eml
              .file_extension in $file_extensions_macros
              and any(file.explode(.),
                      .scan.qr.type == "url"
                      // QR code URL contains recipient's email (targeting indicator)
                      and any(recipients.to,
                              .email.domain.valid
                              and (
                                // Plaintext email address in URL
                                strings.icontains(..scan.qr.url.url,
                                                  .email.email
                                )
                                // OR base64 encoded email address
                                or any(strings.scan_base64(..scan.qr.url.url,
                                                           format="url",
                                                           ignore_padding=true
                                       ),
                                       strings.icontains(., ..email.email)
                                )
                              )
                      )
                      // a single path
                      and strings.count(.scan.qr.url.path, '/') == 2
                      and (
                        (
                          (
                            strings.contains(.scan.qr.url.path, '/$')
                            or strings.contains(.scan.qr.url.path, '/*')
                            or strings.contains(.scan.qr.url.path, '/#')
                          )
                          // subdomain should contain num{3}alpha or alphanum{3}
                          and regex.icontains(.scan.qr.url.domain.subdomain,
                                              '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                          )
                          // url path should contain num{3}alpha or alphanum{3}
                          and regex.icontains(.scan.qr.url.path,
                                              '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                          )
                        )
                        or (
                          // special char in the path
                          (
                            strings.contains(.scan.qr.url.path, '!')
                            or strings.contains(.scan.qr.url.path, '@')
                          )
                          and (
                            strings.contains(.scan.qr.url.path, '/$')
                            or strings.contains(.scan.qr.url.path, '/*')
                            or strings.contains(.scan.qr.url.path, '/#')
                            // hex dollar sign
                            or strings.icontains(.scan.qr.url.path, '%24')
                            // hex star
                            or strings.icontains(.scan.qr.url.path, '%2A')
                            // hex pound
                            or strings.icontains(.scan.qr.url.path, '%23')
                          )
                          // ensure expected ordering
                          and regex.icontains(.scan.qr.url.url,
                                              '[!@].*(?:[$*]|%2[A43])'
                          )
                        )
                      )
              )
            )
            or (
              // looks for pdfs and images in the attached eml
              //
              // This rule makes use of a beta feature and is subject to change without notice
              // using the beta feature in custom rules is not suggested until it has been formally released
              //
              any(beta.scan_qr(.).items,
                  .type is not null
                  // a single path
                  and strings.count(.url.path, '/') == 2
                  and (
                    (
                      (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                      )
                      // subdomain should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.domain.subdomain,
                                          '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                      )
                      // url path should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.path,
                                          '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                      )
                    )
                    or (
                      // special char in the path
                      (
                        strings.contains(.url.path, '!')
                        or strings.contains(.url.path, '@')
                      )
                      and (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                        // hex dollar sign
                        or strings.icontains(.url.path, '%24')
                        // hex star
                        or strings.icontains(.url.path, '%2A')
                        // hex pound
                        or strings.icontains(.url.path, '%23')
                      )
                      // ensure expected ordering
                      and regex.icontains(.url.url, '[!@].*(?:[$*]|%2[A43])')
                    )
                  )
              )
            )
        )
)