Detects inbound messages with a ZIP attachment that contains an Office binary and an embedded DLL by performing archive analysis and YARA-based file analysis. The rule executes when a message is inbound, filters for attachments where file_type equals 'zip', explodes the archive, and evaluates YARA matches for a signature named 'zip_office_bin_dll'. A match indicates potential malware/ransomware delivery attempting evasion by nesting a DLL inside a bundled Office binary. The rule uses archive analysis, file analysis, and YARA detection methods and is assigned medium severity. It is intended for network or gateway defenses inspecting inbound mail content and leveraging YARA-based signatures to identify complex packaging techniques.