Link: QR code with phishing disposition in img or pdf

type.inbound
and length(attachments) < 10
and any(attachments,
        (.file_type in $file_types_images or .file_type == "pdf")
        and any(file.explode(.),
                .scan.qr.type == "url"

                // linkanalysis phishing disposition
                and any([ml.link_analysis(.scan.qr.url)],
                        .credphish.disposition == "phishing"
                )
                and .scan.qr.url.domain.root_domain not in $org_domains
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
  or (
    sender.email.domain.domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
    // no messages from this sender email have been marked benign
    not profile.by_sender_email().any_messages_benign
    // or it's a spoof of the org_domain
    or (
        sender.email.domain.domain in $org_domains
        and not headers.auth_summary.dmarc.pass
    )
)