Attachment: RTF with Embedded OLE Object (Unsolicited)

type.inbound

and any(attachments,
    (
        // RTF is a direct attachment or this is an archive format
        .file_type == "rtf"
        or .file_extension in $file_extensions_common_archives
    ) 
    and any(file.explode(.),
        // The file is an RTF
        .file_extension == "rtf" and 
        
        //   {\rtf1{\object\objhtml\objw1\objh1\objupdate\rsltpict{\*\objclass delivr}{\*\objdata ...
        any(.scan.strings.strings, strings.ilike(., "*\\object*")) and 
        any(.scan.strings.strings, strings.ilike(., "*\\objhtml*")) and 
        any(.scan.strings.strings, strings.ilike(., "*\\objupdate*")) and 
        any(.scan.strings.strings, strings.ilike(., "*\\objdata*"))
    )
)
and (
    (
        not profile.by_sender_email().solicited
        and profile.by_sender_email().prevalence in ("new", "outlier")
    )
    or (
        profile.by_sender_email().any_messages_malicious_or_spam
        and not profile.by_sender_email().any_false_positives
    )
    or sender.email.domain.domain == "delivrto.me"
)