Attachment soliciting user to enable macros

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_macros
          or .file_extension in~ $file_extensions_common_archives
          or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
          )
        )
        and any(file.explode(.),
                strings.ilike(.scan.ocr.raw, "*please*enable*macros")
                or any(.scan.strings.strings, strings.ilike(., "*please enable macros*"))
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)