type.inbound
and (
any(body.links,
(
.href_url.domain.root_domain == "hakumonkai.org"
and .href_url.path == "/fukkou/ref.php"
and any(.href_url.query_params_decoded["url"],
strings.parse_url(.).domain.valid
)
)
)
or any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.url.urls,
(
.domain.root_domain == "hakumonkai.org"
and .path == "/fukkou/ref.php"
and any(.query_params_decoded["url"],
strings.parse_url(.).domain.valid
)
)
)
)
)
)
Playground
Test against your own EMLs or sample data.