Sublime MQL rules: abuse

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // eviltokens cloudflare workers domain struct
        (
          strings.iends_with(.href_url.domain.domain, '-account.workers.dev')
          and regex.icontains(.href_url.domain.domain,
                              '^(?:(?:page-)?adobe|calendar_invite|(?:page-)?docusign|fax|quarantine|onedrive|page-password|sharepoint|voicemail|index)-[a-z0-9]{3}\.[a-z0-9-]{3,}'
          )
        )
)

type.inbound
and sender.email.email == "noreply@robinhood.com"
and any(html.xpath(body.html, '//div/ul[count(li) = 4]/li').nodes,
        length(.raw) > 500 and strings.count(.raw, "</") > 10
)

type.inbound

// Legitimate Intuit sending infratructure
and sender.email.email == "quickbooks@notification.intuit.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
                      '.intuit.com'
)
and (
  // the reply-to contains Inuit Themes
  any(headers.reply_to,
      (
        strings.icontains(.email.email, 'intuit')
        or strings.icontains(.email.domain.domain, 'quickbooks')
      )
      and not (.email.domain.root_domain in ('intuit.com', 'quickbooks.com'))
  )
  // the "company" part of the message
  or regex.icontains(body.html.raw,
                     '<(?:div|p) class="company(?:Name|Details)[^\"]*\"[^\>]*\>[^\<]*(?:Intuit|Quickbooks).*</(?:p|div)>'
  )
)

type.inbound
// allow for multiple google TLDs
and sender.email.domain.sld == "google"
and headers.auth_summary.spf.pass
// g.co url shortner in links or the current thread to identify the workspace name
and (
  any(body.links,
      .href_url.domain.root_domain == 'g.co'
      and .href_url.domain.subdomain is not null
  )
  or (
    strings.icontains(body.current_thread.text, '.g.co')
    and regex.icontains(body.current_thread.text, '[^\s]+\.g\.co\b')
  )
)

type.inbound

// Legitimate Adobe Sign sending infratructure
and sender.email.email == "adobesign@adobesign.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.icontains(subject.subject, 'signature requested')

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//

// reply-to address has never sent an email to the org
and beta.profile.by_reply_to().prevalence == "new"

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

type.inbound
and sender.email.email == 'no-reply@amazon.com'
and subject.base == 'Your invitation has been sent'
and any(html.xpath(body.html, "//h2[contains(@class, 'rio-header')]").nodes,
        // phone number regex
        regex.icontains(strings.replace_confusables(.display_text),
                        '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)

type.inbound
and length(body.current_thread.text) < 10000
and strings.ilike(body.current_thread.text,
                  "*proposal*",
                  "*specified link*",
                  "*secure*"
)
and length(filter(body.current_thread.links,
                  .href_url.domain.root_domain == 'behance.net'
                  and strings.icontains(.href_url.path, '/gallery/')
                  and .display_url.domain.root_domain == 'behance.net'
                  and strings.icontains(.display_url.path, '/gallery/')
           )
) == 1
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound

// Legitimate Box sending infrastructure
and sender.email.domain.root_domain == "box.com"

// ML classification indicates credential theft with high confidence
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  // Link analysis for credential phishing detection
  or any(filter(body.links,
                // target the box link
                (
                  .href_url.domain.domain == "app.box.com"
                )
         ),
         ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
         and ml.link_analysis(., mode="aggressive").credphish.confidence in (
           "medium",
           "high"
         )
  )
)
// Box file sharing patterns
and (
  strings.icontains(subject.subject, 'invited you to')
  or strings.icontains(subject.subject, 'shared')
  or strings.icontains(subject.subject, 'has sent you')
  or strings.icontains(body.current_thread.text, 'Go to File')
  or any(body.links, strings.icontains(.display_text, 'Go to File'))
)

// Suspicious document patterns or VIP impersonation
and (
  // Financial document patterns
  (
    regex.icontains(subject.subject,
                    '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or regex.icontains(body.current_thread.text,
                       '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or any(body.links,
           regex.icontains(.display_text,
                           '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
           )
    )
  )
  // Corporate document patterns
  or (
    regex.icontains(subject.subject,
                    '\b(urgent|important|confidential|secure|encrypted|document|file)\b'
    )
    and regex.icontains(subject.subject,
                        '\b(review|approval|signature|verification|validation)\b'
    )
  )
)

type.inbound
//
//  Warning: This rule contains sexually explicit keywords
//
and sender.email.email == 'notifications@demio.com'
and (
  // phone number regex
  regex.icontains(subject.base,
                  '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                  '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
  )
  // dollar amounts
  or regex.icontains(subject.base, '(?:USD|\$)\s?\d')
  or regex.icontains(subject.base, '\d+\.\d{2}\s?(?:USD|usd)')
  // suspicious TLDs
  or regex.icontains(subject.base,
                     '\.(?:ac\.th|biz\.id|co\.(?:cl|id|za)|com\.(?:ge|py)|my\.id|ne\.jp|net\.ms|nom\.za|web\.id|accountants|am|app|ar|army|beauty|best|bet|bio|biz|bond|cam|cc|cf|cfd|chat|cl|click|cloud|club|cm|company|consulting|country|cricket|cyou|date|dev|digital|directory|domains|download|enterprises|es|expert|fashion|finance|fit|foo|free|fun|ga|gdn|gf|gq|gu|help|i2p|icu|il|ing|ink|ir|jetzt|kim|kz|lat|life|limited|link|live|loan|lol|ltd|ly|me|meme|men|ml|mom|monster|mov|mq|one|online|ooo|party|photos|pictures|pizza|press|pro|pub|pw|racing|re|ren|rest|review|ro|rsvp|ru|run|sale|sbs|science|shop|site|so|social|solutions|space|store|stream|su|sx|tech|tk|today|tokyo|top|trade|tt|ua|uno|us|vip|vu|wang|website|win|work|works|world|ws|xin|xyz|zip|zone)\b'
  )
  // dating/spam/explicit content lures
  or regex.icontains(strings.replace_confusables(subject.base),
                     '(?:\bs\s?e\s?x\b|horny|hook.?up|private room|wanna meet|wants to meet|naked|porn|webcam|nudes?|sexting|erotic|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|bed partner)'
  )
  // action verbs + length
  or (
    strings.count(subject.base, " ") > 8
    and regex.icontains(strings.replace_confusables(subject.base),
                        '(?:call|dial|speak to|contact \d|to (?:stop|void|reverse|confirm|secure|verify|unfreeze))'
    )
  )
)

type.inbound

// Legitimate DocSend sending infratructure
and sender.email.email == "no-reply@docsend.com"

// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

type.inbound

// Legitimate DocSend sending infratructure
and sender.email.email == "no-reply@docsend.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass

// the message needs to have a reply-to address
and length(headers.reply_to) > 0

// reply-to email address has never received an email from your org
and not any(headers.reply_to, .email.email in $recipient_emails)

// new reply-to
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)

type.inbound
and length(attachments) == 0

// Legitimate Docusign sending infratructure
and sender.email.domain.root_domain == 'docusign.net'
and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
and length(headers.reply_to) > 0
and not any(headers.reply_to,
            .email.domain.domain in $org_domains
            or .email.domain.root_domain in $high_trust_sender_root_domains
            or .email.domain.root_domain in ("docusign.net", "docusign.com")
)
// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 

// reply-to address has never sent an email to the org
and beta.profile.by_reply_to().prevalence == "new"

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

// not a completed DocuSign
// reminders are sent automatically and can be just as malicious as the initial
// users often decline malicious ones
and not strings.istarts_with(subject.subject, "Completed: ")
and not strings.istarts_with(subject.subject, "Here is your signed document: ")
and not strings.istarts_with(subject.subject, "Voided: ")
and (
  // contains the word docusign before the `via Docusign` part
  regex.icontains(sender.display_name, 'Docusign.*via Docusign$')
  or strings.icontains(subject.subject, 'sharefile')
  or strings.icontains(subject.subject, 'helloshare')

  // sender names part of the subject
  or (
    // Billing Accounting
    regex.icontains(sender.display_name,
                    'Accounts? (?:Payable|Receivable).*via Docusign$',
                    'Billing Support.*via Docusign$'
    )

    // HR/Payroll/Legal/etc
    or regex.icontains(sender.display_name, 'Compliance HR.*via Docusign$')
    or regex.icontains(sender.display_name,
                       '(?:Compliance|Executive|Finance|\bHR\b|Human Resources|\bIT\b|Legal|Payroll|Purchasing|Operations|Security|Training|Support).*(?:Department|Team)?.*via Docusign$'
    )
    or regex.icontains(sender.display_name,
                       'Corporate Communications.*via Docusign$'
    )
    or regex.icontains(sender.display_name, 'Employee Relations.*via Docusign$')
    or regex.icontains(sender.display_name, 'Office Manager.*via Docusign$')
    or regex.icontains(sender.display_name, 'Risk Management.*via Docusign$')
    or regex.icontains(sender.display_name,
                       'Payroll Admin(?:istrator).*via Docusign$'
    )

    // IT related
    or regex.icontains(sender.display_name,
                       'IT Support.*via Docusign$',
                       'Information Technology.*via Docusign$',
                       '(?:Network|System)? Admin(?:istrator).*via Docusign$',
                       'Help Desk.*via Docusign$',
                       'Tech(?:nical) Support.*via Docusign$'
    )
  )
  // filename analysis
  // the filename is also contained in the subject line
  or (
    // scanner themed
    regex.icontains(subject.subject, 'scanne[rd]')
    // image theme
    or regex.icontains(subject.subject, '_IMG_')
    or regex.icontains(subject.subject, 'IMG[_-](?:\d|\W)+')

    // Invoice Themes
    or regex.icontains(subject.subject, 'Invoice')
    or regex.icontains(subject.subject, 'INV\b')
    or regex.icontains(subject.subject, 'Payment')
    or regex.icontains(subject.subject, '\bACH\b')
    or regex.icontains(subject.subject, 'Wire Confirmation')
    or regex.icontains(subject.subject, 'P[O0]\W+?\d+\"')
    or regex.icontains(subject.subject, 'P[O0](?:\W+?|\d+)')
    or regex.icontains(subject.subject, 'receipt')
    or regex.icontains(subject.subject, 'Billing')
    or regex.icontains(subject.subject, 'statement')
    or regex.icontains(subject.subject, 'Past Due')
    or regex.icontains(subject.subject, 'Remit(?:tance)?')
    or regex.icontains(subject.subject, 'Purchase Order')
    or regex.icontains(subject.subject, 'Settlementt')

    // contract language
    or regex.icontains(subject.subject, 'Pr[0o]p[0o]sal')
    or regex.icontains(subject.subject, 'Claim Doc')

    // Payroll/HR
    or regex.icontains(subject.subject, 'Payroll')
    or regex.icontains(subject.subject, 'Employee Pay\b')
    or regex.icontains(subject.subject, 'Salary')
    or regex.icontains(subject.subject, 'Benefit Enrollment')
    or regex.icontains(subject.subject, 'Employee Handbook')
    or regex.icontains(subject.subject, 'Reimbursement Approved')

    // 
    // shared files/extenstion/urgency/CTA
    or regex.icontains(subject.subject, 'Urgent')
    or regex.icontains(subject.subject, 'Important')
    or regex.icontains(subject.subject, 'Secure')
    or regex.icontains(subject.subject, 'Encrypt')
    or regex.icontains(subject.subject, 'shared')
    or regex.icontains(subject.subject, 'protected')
    or regex.icontains(subject.subject, 'Validate')
    or regex.icontains(subject.subject, 'Action Required')
    or regex.icontains(subject.subject, 'Final Notice')
    or regex.icontains(subject.subject, 'Review(?: and| & |\s+)?Sign')
    or regex.icontains(subject.subject, 'Download PDF')

    // MFA theme
    or regex.icontains(subject.subject, 'Verification Code')
    or regex.icontains(subject.subject, '\bMFA\b')
  )
)

type.inbound

// message is from docusign actual
and sender.email.domain.root_domain == 'docusign.net'
and not any(headers.reply_to, .email.domain.domain == 'docusign.com')
and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)

// not a completed DocuSign
// reminders are sent automatically and can be just as malicious as the initial
// users often decline malicious ones
and not strings.istarts_with(subject.subject, "Completed: ")
and not strings.istarts_with(subject.subject, "Here is your signed document: ")
and not strings.istarts_with(subject.subject, "Voided: ")

// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 

// reply-to address rarely seen in org
and beta.profile.by_reply_to().prevalence in~ ("new", "rare")

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

type.inbound
and sender.email.domain.root_domain == 'domainsbyproxy.com'

type.inbound

// Legitimate Dropbox sending infratructure
and sender.email.email == "no-reply@dropbox.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
                      '.dropbox.com'
)
and strings.icontains(subject.subject, 'shared')
and strings.icontains(subject.subject, 'with you')

//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//

// reply-to address has never sent an email to the org
and beta.profile.by_reply_to().prevalence == "new"

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

type.inbound

//  Dropbox actual sending infrastructure
and sender.email.email == "no-reply@dropbox.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
                      '.dropbox.com'
)

// the message needs to have a reply-to address
and length(headers.reply_to) > 0

// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 

// reply-to email address has never been sent an email by the org
and not beta.profile.by_reply_to().solicited

// do not match if the reply_to address has been observed as a reply_to address
// of a message that has been classified as benign
and not beta.profile.by_reply_to().any_messages_benign

// new reply-to domain
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)

type.inbound

// Legitimate Dropbox sending infratructure
and sender.email.email == "no-reply@dropbox.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and strings.ends_with(headers.auth_summary.spf.details.designator,
                      '.dropbox.com'
)
and strings.icontains(subject.subject, 'shared')
and strings.icontains(subject.subject, 'with you')
and (
  // contains the word dropbox
  // everything not "shared" and "with you" is actor controlled
  strings.icontains(subject.subject, 'dropbox')
  or strings.icontains(subject.subject, 'sharefile')

  // sender names part of the subject
  or (
    // Billing Accounting
    regex.icontains(subject.subject,
                    'Accounts? (?:Payable|Receivable).*shared',
                    'Billing Support.*shared'
    )

    // HR/Payroll/Legal/etc
    or regex.icontains(subject.subject, 'Compliance HR.*shared')
    or regex.icontains(subject.subject,
                       '(?:Compliance|Executive|Finance|\bHR\b|\bIT\b|Legal|Payroll|Purchasing|Operations|Security|Training|Support).*shared'
    )
    or regex.icontains(subject.subject, '(?:Department|Team).*shared')
    or regex.icontains(subject.subject, 'Corporate Communications.*shared')
    or regex.icontains(subject.subject, 'Employee Relations.*shared')
    or regex.icontains(subject.subject, 'Office Manager.*shared')
    or regex.icontains(subject.subject, 'Risk Management.*shared')
    or regex.icontains(subject.subject, 'Payroll Admin(?:istrator).*shared')
    or regex.icontains(subject.subject, 'Human Resources.*shared')
    or regex.icontains(subject.subject, 'HR.*shared')

    // IT related
    or regex.icontains(subject.subject,
                       'IT Support.*shared',
                       'Information Technology.*shared',
                       '(?:Network|System)? Admin(?:istrator).*shared',
                       'Help Desk.*shared',
                       'Tech(?:nical) Support.*shared'
    )

    // an email address in the subject is also interesting
    or regex.icontains(subject.subject, '\w+@\w+\.\w+.*shared')
  )
  // filename analysis
  // the filename is also contianed in the subject line
  or (
    // untitled.paper
    regex.icontains(subject.subject, 'shared.*\"Untitled.paper')
    // scanner themed
    or regex.icontains(subject.subject, 'shared.*\".*scanne[rd]')
    // image theme
    or regex.icontains(subject.subject, 'shared.*\".*_IMG_')
    or regex.icontains(subject.subject, 'shared.*\".*IMG[_-](?:\d|\W)+\"')
    // ondrive theme
    or regex.icontains(subject.subject, 'shared.*\".*one_docx')
    or regex.icontains(subject.subject, 'shared.*\".*One.?Drive')
    or regex.icontains(subject.subject, 'shared.*\".*click here')
    or regex.icontains(subject.subject, 'shared.*\".*Download PDF')
    or regex.icontains(subject.subject, 'shared.*\".*Validate')

    // Invoice Themes
    or regex.icontains(subject.subject, 'shared.*\".*Invoice')
    or regex.icontains(subject.subject, 'shared.*\".*INV\b')
    or regex.icontains(subject.subject, 'shared.*\".*Payment')
    or regex.icontains(subject.subject, 'shared.*\".*ACH')
    or regex.icontains(subject.subject, 'shared.*\".*Wire Confirmation')
    or regex.icontains(subject.subject, 'shared.*\".*P[O0]\W+?\d+\"')
    or regex.icontains(subject.subject, 'shared.*\"P[O0](?:\W+?|\d+)')
    or regex.icontains(subject.subject, 'shared.*\".*receipt')
    or regex.icontains(subject.subject, 'shared.*\".*Billing')
    or regex.icontains(subject.subject, 'shared.*\".*statement')
    or regex.icontains(subject.subject, 'shared.*\".*Past Due')
    or regex.icontains(subject.subject, 'shared.*\".*Remit(?:tance)?')
    or regex.icontains(subject.subject, 'shared.*\".*Purchase Order')
    or regex.icontains(subject.subject, 'shared.*\".*Settlement')

    // contract language
    or regex.icontains(subject.subject, 'shared.*\".*Contract Agreement')
    or regex.icontains(subject.subject, 'shared.*\".*Pr[0o]p[0o]sal')
    or regex.icontains(subject.subject, 'shared.*\".*Contract Doc')
    or regex.icontains(subject.subject, 'shared.*\".*Claim Doc')

    // Payroll/HR
    // section also used in link_sharepoint_sus_name.yml with modified input
    or regex.icontains(subject.subject, 'shared.*\".*Payroll')
    or regex.icontains(subject.subject, 'shared.*\".*Employee Pay\b')
    or regex.icontains(subject.subject, 'shared.*\".*Salary')
    or regex.icontains(subject.subject, 'shared.*\".*Benefit Enrollment')
    or regex.icontains(subject.subject, 'shared.*\".*Employee Handbook')
    or regex.icontains(subject.subject, 'shared.*\".*Reimbursement Approved')
    or regex.icontains(subject.subject,
                       'shared.*\".*(?:Faculty|Staff)\s*(?:\w+\s+){0,3}\s*Eval(?:uation)?'
    )

    // shared files/extenstion
    or regex.icontains(subject.subject, 'shared.*\".*Shared.?File')
    or regex.icontains(subject.subject, 'shared.*\".*Urgent')
    or regex.icontains(subject.subject, 'shared.*\".*Important')
    or regex.icontains(subject.subject, 'shared.*\".*Secure')
    or regex.icontains(subject.subject, 'shared.*\".*Encrypt')
    or regex.icontains(subject.subject, 'shared.*\".*shared')
    or regex.icontains(subject.subject, 'shared.*\".*protected')
    or regex.icontains(subject.subject, 'shared.*\".*\.docx?\.pdf')
    or regex.icontains(subject.subject, 'shared.*\".*\.docx?\.paper')
    // all caps filename allowing for numbers, punct and spaces, and an optional file extenstion
    or regex.contains(subject.subject,
                      'shared \"[A-Z0-9[:punct:]\s]+(?:\.[a-zA-Z]{3,5})\"'
    )
    or regex.icontains(subject.subject,
                       'shared \".*(?:shared|sent).*\" with you'
    )

    // MFA theme
    or regex.icontains(subject.subject, 'shared.*\".*Verification Code')
    or regex.icontains(subject.subject, 'shared.*\".*\bMFA\b')

    // the reply-to address is within the subject
    or any(headers.reply_to,
           strings.icontains(subject.subject, .email.domain.domain)
    )
  )
)

type.inbound
// a link whose effective destination is evernote
and any(body.current_thread.links,
        (
          .href_url.domain.root_domain == "evernote.com"
          or .display_url.domain.root_domain == "evernote.com"
          or any(.href_url.query_params_decoded["domain"],
                 strings.iends_with(., "evernote.com")
          )
        )
        and (
          any(ml.nlu_classifier(.display_text).topics, .name == 'E-Signature')
          or regex.icontains(.display_text,
                             '\b(?:view|open|review|access|download|see|shared?)\b[^\n]{0,30}\b(?:document|doc|file|contract|invoice|statement|agreement|draft|attachment|folder)\b'
          )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ('cred_theft', 'bec') and .confidence != 'low'
)
and not (
  sender.email.domain.root_domain == 'evernote.com'
  and coalesce(headers.auth_summary.dmarc.pass, false)
)