Brand impersonation: Adobe Acrobat Sign PDF phishing file format template

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        (
          any(ml.logo_detect(.).brands, .name == "Adobe")
          or strings.icontains(beta.ocr(.).text,
                               'Powered by Adobe Acrobat Sign'
          )
          or strings.icontains(beta.ocr(.).text, 'Adobe Acrobat Sign')
        )
        and strings.icontains(beta.ocr(.).text, 'File Format: PDF')
)