Service abuse: Citrix ShareFile impersonation via Outlook plugin

type.inbound
and any(attachments,
        .file_type in ("doc", "docx")
        and any(file.explode(.),
                strings.icontains(.scan.strings.raw, "sharefile.com")
                and strings.icontains(.scan.strings.raw,
                                      "src=system-email-outlookplugin-new"
                )
        )
)