describe SHIPPING_ID Contains a long ID number at the end
score SHIPPING_ID 3
-meta FEDEX_ZIP (FEDEXPACKAGE || SHIPPING_ID ) && ( ZIPCOMPRESSED || ZIPFILE )
+rawbody MSWORD /application\/msword/
+describe MSWORD Has a word attachment
+score MSWORD 2
+
+meta FEDEX_ZIP (FEDEXPACKAGE || SHIPPING_ID ) && ( ZIPCOMPRESSED || ZIPFILE || MSWORD )
describe FEDEX_ZIP Fedex package with zip file
score FEDEX_ZIP 3