PDF embeds a script file as an attachment

Benign PDF attachments are documents, spreadsheets or images. A script attachment has no magic bytes for the content classifier to key off, so it previously surfaced only as a generic 'Embedded file' finding. The rule reads the /F and /UF filespec names and escalates to high severity when the document also contains a literal IPv4:port URL — a script payload alongside a hardcoded staging endpoint. Security-range and CTF artifacts do legitimately bundle scripts, which is why the bare case stays medium.