type.inbound
and any(attachments,
(
regex.imatch(.file_extension, '^[sdx]{0,1}ht[ml]{0,2}$') or
.file_extension in~ $file_extensions_common_archives or
.file_type == "html"
)
and any(file.explode(.),
any(.flavors.yara, . == "javascript_file") and
any(.scan.strings.strings,
regex.icontains(., "eval") and
length(.) > 500 and
regex.icontains(., '(.*\\x\w\w.*){20}')
)
)
)
and (
not profile.by_sender_email().solicited
or sender.email.domain.domain == "delivrto.me"
)
Playground
Test against your own EMLs or sample data.