Attachment: SVG file with Onerror or Onload (Unsolicited)

type.inbound
and any(attachments, 
    any(file.explode(.),
        (
          .file_extension == "svg" or 
          .flavors.mime == "image/svg+xml" or 
          any(.flavors.yara, . == "svg_file")
        ) and
        (
            any(.scan.strings.strings,
                strings.icontains(., "onload") or 
                strings.icontains(., "onerror")
            ) or
            any(.scan.yara.matches, 
                .name == "SUSP_SVG_Onload_Onerror_Jul23"
            )
        )
    )
)
and (
  not profile.by_sender_email().solicited
  or sender.email.domain.domain == "delivrto.me"
)