Link: ScreenConnect installer with suspicious relay domain

type.inbound
and any(body.links,
        strings.ends_with(.href_url.url, ".exe")
        and any(ml.link_analysis(., mode="aggressive").files_downloaded,
                any(file.explode(.),
                    any(.scan.strings.strings,
                        strings.icontains(., "ScreenConnect")
                    )
                    and any(filter(.scan.strings.strings,
                                   strings.icontains(., "h=") // relay domain
                                   and strings.icontains(., "k=") // encoded encryption key
                            ),
                            any(regex.extract(., 'h=(?P<url>[^&]+)'),
                                strings.parse_url(strings.concat("https://",
                                                                 .named_groups["url"]
                                                  )
                                ).domain.root_domain not in $org_domains
                                and strings.parse_url(strings.concat("https://",
                                                                     .named_groups["url"]
                                                      )
                                ).domain.root_domain != sender.email.domain.root_domain
                            )
                    )
                )
        )
)
and not profile.by_sender_email().any_messages_benign