Attachment: WinRAR CVE-2025-8088 exploitation

type.inbound 
and any(attachments, 
    // its a rar file
    (
        .content_type == "application/x-rar-compressed"
        or .file_extension == "rar"
        or .file_type == "rar"
    )
    // less than 10 meg
    and .size < 10000000
    // explode it
    and any(file.explode(.), 
        // contains a yara match
        any(.scan.yara.matches, .name == "WinRAR_CVE_2025_8088")
    )
)