Malware: Pikabot delivery via URL auto-download

type.inbound
and any(body.links,
        regex.imatch(.display_url.url, '.+\/[a-z0-9]+\/\?[0-9a-z]+')
)
and (
  any(body.links,
      .href_url.domain.domain in $abuse_ch_urlhaus_domains_trusted_reporters
      and not .href_url.domain.domain in ("drive.google.com", "github.com")
  )
  or any(body.links,
         any(ml.link_analysis(., mode="aggressive").files_downloaded,
             .file_extension in~ $file_extensions_common_archives
             and (
               any(file.explode(.),
                   .file_extension =~ "js"
                   or .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
               )
             )
         )
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)