Attachment: RTF with embedded content

type.inbound
and any(attachments,
        .file_type == "rtf"
        and any(file.explode(.),
                .flavors.mime in~ (
                  "application/x-dosexec",
                  "text/x-msdos-batch",
                  "application/octet-stream"
                )
                or any(.flavors.yara, . == 'base64_pe')
                or .file_extension in~ ("bat", "exe", "vbs")
        )
)