Link: Multistage landing - Abused Adobe Acrobat hosted PDF

type.inbound
and any(body.links,
        .href_url.domain.domain == "acrobat.adobe.com"
        and strings.istarts_with(.href_url.path, '/id/urn:')
)
and length(distinct(filter(body.links,
                           .href_url.domain.domain == "acrobat.adobe.com"
                           and strings.istarts_with(.href_url.path, '/id/urn:')
                    ),
                    .href_url.url
           )
) == 1
and any(filter(body.links,
               .href_url.domain.domain == "acrobat.adobe.com"
               and strings.istarts_with(.href_url.path, '/id/urn:')
        ),
        any(ml.link_analysis(., mode="aggressive").additional_responses,
            (
              any(file.explode(.file),
                  any(.scan.exiftool.fields,
                      // password protected pdf
                      .key == "Warning"
                      and strings.icontains(.value, "password protected")
                  )
              )
              // a low amount of links
              or (
                any(file.explode(.file), 1 <= length(.scan.url.urls) <= 2)
                // a single page
                and any(file.explode(.file),
                        .scan.exiftool.page_count == 1
                        // occurs when there are exif errors
                        or .scan.exiftool.page_count is null
                )
                // susipicious indicators
                and (
                  // logo detection of brands for file sharing companies
                  any(ml.logo_detect(.file).brands,
                      .name in ("DocuSign", "Adobe")
                      or strings.istarts_with(.name, 'Microsoft')
                  )
                  // look at the OCR of the document as well
                  or (
                    length(beta.ocr(.file).text) < 750
                    and (
                      regex.icontains(beta.ocr(.file).text, 'e-sign(?:ature)?')
                      or strings.icontains(beta.ocr(.file).text,
                                           'shared a document',
                                           'review and sign',
                                           'PDF viewer',
                                           "display this type of document",
                                           'please wait...',
                                           'New PDF Document',
                                           'view document',
                                           'open the secure review session'
                      )
                    )
                  )
                )
              )
            )
        )
)
and length(headers.references) == 0
and headers.in_reply_to is null