Brand impersonation: DocuSign (QR code)

type.inbound
and any(attachments,
        (.file_type in $file_types_images or .file_type == "pdf")
        and (
          any(ml.logo_detect(.).brands,
              .name == "DocuSign" and .confidence in ("medium", "high")
          )
          or any(ml.logo_detect(file.message_screenshot()).brands,
                 .name == "DocuSign"
          )
        )
        and (
          any(file.explode(.),
              (
                (
                  .scan.qr.type is not null
                  and regex.contains(.scan.qr.data, '\.')
                )
                or 
                // QR code language
                (
                  regex.icontains(.scan.ocr.raw, 'scan|camera')
                  and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
                )
              )

              // exclude images taken with mobile cameras and screenshots from android
              and not any(.scan.exiftool.fields,
                          .key == "Model"
                          or (
                            .key == "Software"
                            and strings.starts_with(.value, "Android")
                          )
              )
              // exclude images taken with mobile cameras and screenshots from Apple
              and not any(.scan.exiftool.fields,
                          .key == "DeviceManufacturer"
                          and .value == "Apple Computer Inc."
              )
          )
        )
)
and not (
  sender.email.domain.root_domain in ("docusign.net", "docusign.com")
  and headers.auth_summary.dmarc.pass
)