type.inbound
and any(attachments,
.file_extension in~ ("exe", "sfx")
and any(file.explode(.),
any(.scan.strings.strings,
strings.ilike(.,
'CMT;The comment below contains SFX script commands'
)
)
and any(.scan.strings.strings, strings.ilike(., 'Setup=*'))
)
)
Playground
Test against your own EMLs or sample data.