Sublime MQL rules: body

type.inbound
and (
  sender.email.domain.domain in $free_email_providers
  or (
    length(headers.reply_to) > 0
    and all(headers.reply_to,
            (
              .email.domain.root_domain in $free_email_providers
              or .email.domain.tld in $suspicious_tlds
              or (
                network.whois(.email.domain).days_old < 365
                and length(coalesce(body.html.raw, "")) == 0
              )
            )
            and .email.email != sender.email.email
    )
  )
  or sender.email.domain.tld in $suspicious_tlds
  or any(["jp", "jo"], strings.iends_with(sender.email.domain.tld, .))
  or (
    length(recipients.to) == 0
    and any(headers.reply_to,
            .email.domain.root_domain != sender.email.domain.root_domain
    )
  )
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "advance_fee" and .confidence in ("medium", "high")
  )
  or (
    length(body.current_thread.text) < 200
    and regex.icontains(body.current_thread.text,
                        '(?:donation|inheritence|\$\d,\d{3}\,\d{3}|lottery)'
    )
    and not regex.icontains(body.current_thread.text,
                            '(?:closed.{0,50})?\$\d,\d{3}\,\d{3}.{0,100}(?:homes|realty|sale)?'
    )
    and not any(body.links,
                regex.icontains(.href_url.url,
                                '(?:donation|inheritence|\$\d,\d{3}\,\d{3}|lottery)'
                )
    )
    and (
      (
        (length(headers.references) > 0 or headers.in_reply_to is null)
        and not (
          (
            strings.istarts_with(subject.subject, "RE:")
            // out of office auto-reply
            or strings.istarts_with(subject.subject, "Automatic reply:")
            or strings.istarts_with(subject.subject, "R:")
            or strings.istarts_with(subject.subject, "ODG:")
            or strings.istarts_with(subject.subject, "答复:")
            or strings.istarts_with(subject.subject, "AW:")
            or strings.istarts_with(subject.subject, "TR:")
            or strings.istarts_with(subject.subject, "FWD:")
            or regex.icontains(subject.subject,
                               '^(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:'
            )
          )
        )
      )
      or any(headers.reply_to, .email.email != sender.email.email)
    )
  )
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign

type.inbound
and length(attachments) > 0
// 3 instances of zip/encrypted/payment information
and 3 of (
  regex.icontains(body.current_thread.text, 'zip file.{1,50}encrypted'),
  regex.icontains(body.current_thread.text, 'attachment.{1,30}encrypted'),
  regex.icontains(body.current_thread.text,
                  'password.{1,5}is.{1,5}[A-Z0-9]{8,}'
  ),
  regex.icontains(body.current_thread.text,
                  'details.{1,20}payment.{1,30}attach'
  ),
  strings.icontains(subject.subject, "you have received"),
  strings.icontains(subject.subject, "new debit"),
  strings.icontains(subject.subject, "payment confirmation"),
  strings.icontains(subject.subject, "invoice attached")
)
and (
  // one attachment included and the file is a zip
  attachments[0].file_extension == "zip"
  and (
    regex.icontains(attachments[0].file_name,
                    'payment|invoice|receipt|document|bank'
    )
    // long uppercase passwords
    or regex.contains(body.current_thread.text, '[A-Z]{10,}')
  )
)

type.inbound
// subject contains investment language
and (
  strings.istarts_with(subject.base, 'financing for', 'investment into')
  or strings.icontains(subject.base, "family office")
)

// financial body content
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name == "Financial Communications" and .confidence != "low"
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "B2B Cold Outreach" and .confidence != "low"
    )
    and regex.icontains(body.current_thread.text,
                        'funding',
                        'capital',
                        '\d{3}k',
                        'rates from \d+%',
                        'funded in \d+',
                        'family office'
    )
  )
)

// suspicious sender
and (
  sender.email.domain.tld in $suspicious_tlds
  or sender.email.domain.tld == "info"
)

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("greeting", "salutation")
)

// most likely to occur in plain text
and (
  body.html.raw is null
  or 

  // HTML is not null but fake thread
  (
    subject.is_reply or subject.is_forward
  )
  and (
    (length(headers.references) == 0 and headers.in_reply_to is null)
    or headers.in_reply_to is null
  )
)
and (
  3 of (
    any([subject.subject, body.current_thread.text],
        regex.icontains(., '(full|part).time')
    ),
    strings.ilike(body.current_thread.text, '*job*'),
    regex.icontains(body.current_thread.text, '\bHR\b'),
    strings.ilike(body.current_thread.text, '*manager*'),
    strings.ilike(body.current_thread.text, '*commission*'),
    strings.ilike(body.current_thread.text, '*hourly*'),
    strings.ilike(body.current_thread.text, '*per hour*'),
    strings.ilike(body.current_thread.text, '*prior experience*'),
    strings.ilike(body.current_thread.text, '*company rep*'),
    strings.ilike(body.current_thread.text, "100% legal")
  )
  or (
    length(ml.nlu_classifier(body.current_thread.text).topics) == 1
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Professional and Career Development"
            and .confidence == "high"
    )
    and (
      length(recipients.to) == 0
      or all(recipients.to,
             strings.ilike(.display_name, "Undisclosed?recipients")
      )
    )
  )
)

// all attachments are images or there's no attachments
and (
  (
    length(attachments) > 0
    and all(attachments, .file_type in $file_types_images)
  )
  or length(attachments) == 0
)

// there's an email in the body and it's a freemail
and any(regex.extract(body.current_thread.text,
                      "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
        ),
        strings.parse_email(.full_match).domain.domain in $free_email_providers
        or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
)

// and that email doesn't match the sender domain
and (
  all(body.links, .href_url.domain.root_domain != sender.email.domain.domain)
  or sender.email.domain.root_domain in $free_email_providers
)

type.inbound
and network.whois(sender.email.domain).days_old < 30
and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in ("Financial Communications", "Payment Information")
      and .confidence == "high"
  )
)
and (
  (
    regex.icontains(body.current_thread.text,
                    'account\s*(?:number|num|no\.?)\s*:?\s*\d{5,}'
    )
    and regex.icontains(body.current_thread.text,
                        '(?:wire\s*)?routing\s*(?:number|num|no\.?)\s*:?\s*\d{5,}'
    )
  )
  or regex.icontains(body.current_thread.text,
                     'invoice\s*(?:#|number|num|no\.?)\s*:?\s*[A-Z0-9-]{3,}',
                     'per\s+\w+.{0,5}s\s+request'
  )
  or strings.icontains(body.current_thread.text,
                       'due upon receipt',
                       'confirm receipt of invoice',
                       'see attached invoice'
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and (
  (
    regex.icontains(body.html.raw,
                    '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
    )
    and any(body.links, .href_url.ip.ip is not null)
  )
  or any(attachments,
         (.content_type == "message/rfc822" or .file_extension =~ "eml")
         and regex.icontains(file.parse_eml(.).body.html.raw,
                             '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
         )
         and any(file.parse_eml(.).body.links, .href_url.ip.ip is not null)
  )
)

type.inbound
and any(html.xpath(body.html, '//div[contains(@style,"clip-path")]').nodes,
        regex.icontains(.raw, 'clip-path:\s*inset\(\s*100%')
        and length(.inner_text) > 150
)

type.inbound
and any(regex.iextract(body.html.raw,
                       'calc\(\s*(?P<n1>\d+(?:\.\d+)?)(?P<u1>px|vw|vh|em|rem|%)\s*-\s*(?P<n2>\d+(?:\.\d+)?)(?P<u2>px|vw|vh|em|rem|%)\s*\)'
        ),
        .named_groups["n1"] == .named_groups["n2"]
        and .named_groups["u1"] == .named_groups["u2"]
)

type.inbound
and subject.base == ""
and strings.icontains(body.current_thread.text, "Secure Emails")
and strings.icontains(body.current_thread.text, "Title:")
and (
  // hidden-@ HTML obfuscation
  regex.icontains(body.html.raw, '<font[^>]+display\s*:\s*none[^>]*>@</font>')
  // recipient root domain echoed back as a portal sender
  or any(recipients.to,
         strings.icontains(body.current_thread.text,
                           strings.concat("acts@", .email.domain.root_domain)
         )
  )
  // template typo
  or strings.icontains(body.current_thread.text, "commuication portal")
  // frozen crId or linkprotect.cudasvc.com inner target
  or any(body.links,
         .href_url.domain.domain == "links.us1.defend.egress.com"
         and (
           strings.icontains(.href_url.query_params,
                             "crId=6a17340ad2523c97775fed21"
           )
           or strings.icontains(.href_url.query_params,
                                "OriginalLink=linkprotect.cudasvc.com"
           )
         )
  )
)

type.inbound
// not a legitimate thread reply or is indicative of self sender
and (
  (length(headers.references) == 0 and headers.in_reply_to is null)
  or (
    length(recipients.to) == 1
    and length(recipients.cc) == 0
    and sender.email.email == recipients.to[0].email.email
  )
)
// whitespace-stuffed credphish targets single recipients
and length(recipients.to) == 1
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
// short lure
and length(body.current_thread.text) < 2000
// HTML whitespace stuffing
and (
  regex.icontains(body.html.raw,
                  '(?:<br\s*/?\s*>\s*){30,}',
                  '(?:<p>\s*(?:&nbsp;|&#160;)\s*</p>\s*){10,}',
                  '(?:<div[^>]*>\s*<br\s*/?\s*>\s*</div>\s*){20,}'
  )
  or (
    regex.icontains(body.html.raw,
                    '(?:<p[^>]*>\s*<o:p>\s*(?:&nbsp;|&#160;)\s*</o:p>\s*</p>\s*){10,}',
                    '(?:<p[^>]*>\s*(?:&nbsp;|&#160;)\s*</p>\s*){30,}'
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name in ("cred_theft", "bec")
    )
  )
)
// low word count excludes legitimate long threads
and regex.count(body.html.display_text, '\S+') < 3000

// visible link in current thread pointing to external domain
and any(body.current_thread.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
        and .href_url.domain.valid
        and .href_url.scheme in ("https", "http")
        and .visible == true
)

// credential phishing has few visible links - newsletters have many
and length(filter(body.current_thread.links,
                  .href_url.domain.valid
                  and .href_url.scheme in ("https", "http")
                  and .visible == true
           )
) < 10

// negate high trust senders that pass auth
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// negate authenticated senders with unsubscribe mechanism (marketing)
and not (
  coalesce(headers.auth_summary.dmarc.pass, false)
  and any(body.current_thread.links,
          strings.icontains(.display_text, "unsubscribe")
          or strings.icontains(.href_url.path, "unsubscribe")
  )
)

type.inbound
and regex.contains(body.html.raw,
                   '(\x{2065}|\x{200E}|\x{200F}|\x{2066}|\x{2067}|\x{2068}|\x{2069}|\x{200B}|\x{200C}|\x{200D}|\x{FEFF}){3}'
)
and regex.contains(body.html.raw,
                   '\d[\x{200E}\x{200F}\x{200B}\x{200C}\x{200D}\x{2065}\x{FEFF}]{1,6}\d'
)
and regex.icontains(body.html.raw,
                    's.{0,6}t.{0,6}u.{0,6}d.{0,6}e.{0,6}n.{0,6}t.{0,10}l.{0,6}o.{0,6}a.{0,6}n'
)

type.inbound
and regex.icontains(body.current_thread.text,
                    'Date:\s(?:Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday)\s(?:January|February|March|April|May|June|July|August|September|October|November|December)\s202(?:5|6|7|8|9)'
)

type.inbound
// table template fingerprint containing "important" and "company"
and any(html.xpath(body.html, '//td[contains(@style, "background-color")]').nodes,
        .display_text == "Important"
)
and any(html.xpath(body.html, '//td[contains(@style, "background-color")]').nodes,
        .display_text == "Company"
)

type.inbound
and regex.icount(body.html.raw, 'data-markjs="true"') >= 2
and strings.icontains(body.html.raw, 'background-color: rgb(255, 241, 0)')

type.inbound
and (length(attachments) < 5 or length(body.links) < 10)
// Microsoft logo
and (
  any(attachments,
      .file_type in $file_types_images
      and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Microsoft"))
  )
  or any(attachments,
         .file_type in $file_types_images
         and (
           any(file.explode(.),
               2 of (
                 strings.ilike(.scan.ocr.raw, "*password*"),
                 strings.ilike(.scan.ocr.raw, "*unread messages*"),
                 strings.ilike(.scan.ocr.raw, "*Shared Documents*"),
                 strings.ilike(.scan.ocr.raw, "*expiration*"),
                 strings.ilike(.scan.ocr.raw, "*office*"),
                 strings.ilike(.scan.ocr.raw, "*expire*"),
                 strings.ilike(.scan.ocr.raw, "*expiring*"),
                 strings.ilike(.scan.ocr.raw, "*kindly*"),
                 strings.ilike(.scan.ocr.raw, "*renew*"),
                 strings.ilike(.scan.ocr.raw, "*review"),
                 strings.ilike(.scan.ocr.raw, "*emails failed*"),
                 strings.ilike(.scan.ocr.raw, "*kicked out*"),
                 strings.ilike(.scan.ocr.raw, "*prevented*"),
                 strings.ilike(.scan.ocr.raw, "*storage quota*"),
                 strings.ilike(.scan.ocr.raw, "*required now"),
                 strings.ilike(.scan.ocr.raw, "*cache*"),
                 strings.ilike(.scan.ocr.raw, "*qr code*"),
                 strings.ilike(.scan.ocr.raw, "*barcode*"),
                 strings.ilike(.scan.ocr.raw, "*security update*"),
                 strings.ilike(.scan.ocr.raw, "*quarantine*")
               )
           )
         )
  )
)

// open redirect
and any(body.links,
        any(.href_url.rewrite.encoders, strings.icontains(., "open_redirect"))
        and not .href_url.domain.root_domain in $org_domains
)
and not (length(headers.references) > 0 or headers.in_reply_to is not null)
and sender.email.domain.root_domain not in $org_domains
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftstoreemail.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com"
)

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("bec") and .confidence == "high"
)
and 
// mismatched From and Reply-to
(
  (
    length(headers.reply_to) > 0
    and all(headers.reply_to,
            .email.domain.root_domain != sender.email.domain.root_domain
    )
  )
  or not headers.auth_summary.dmarc.pass
  or not headers.auth_summary.spf.pass
)

// negate "via" senders via dmarc authentication or gmail autoforwards
and not (
  strings.ilike(headers.return_path.local_part, "*+caf_=*")
  and strings.contains(sender.display_name, "via")
  and (headers.auth_summary.dmarc.pass)
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("bec") and .confidence == "high"
)
// negating legit replies
and not (
  (
    (
      subject.is_reply
      or subject.is_forward
      // out of office auto-reply
      // the NLU model will handle these better natively soon
      or strings.istarts_with(subject.subject, "Automatic reply:")
    )
    and (length(headers.references) > 0 or headers.in_reply_to is not null)
  )
  or (
    // calendar invite responses
    regex.icontains(subject.base,
                    '(?:Accepted|Declined|New Time Proposed|Tentative):'
    )
    and any(attachments, .content_type == "text/calendar")
    and profile.by_sender_email().solicited
  )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and (
  length(body.current_thread.text) < 500
  or any(map(filter(ml.nlu_classifier(body.current_thread.text).entities,
                    .name == "disclaimer"
             ),
             .text
         ),
         (length(body.current_thread.text) - length(.)) < 500
  )
)
and length(attachments) == 0
and regex.icontains(body.current_thread.text,
                    '(?:mobile|contact|current|reliable|latest).{0,10}(?:phone|number|#|\bno)|whatsapp|\bcell|personalcell|(?:share|what).{0,25}number.{0,15}(?:connect|reach|text|message|contact|call)|(?:\bdrop|which|send.{0,5}your|best).{0,25}(?:number|\bnum\b|#).{0,15}(?:(?:connect|reach|contact|call).{0,5}you|text|message|works?\b|stay connected|hit you up)|forward.{0,25}(?:\bnum\b|#)|get (?:your.{0,25}(?:number|\bnum\b|#)|in touch.{0,15}(?:via|by|through).{0,10}(?:text|phone|cell|sms|whatsapp))|(?:provide|confirm|reply.{0,15}with).{0,25}(?:direct|preferred|personal).{0,15}(?:text.?enabled.{0,15})?(?:phone.{0,5})?(?:number|\bnum\b|#|line)|(?:share|send).{0,25}(?:direct|preferred).{0,15}(?:text.?enabled.{0,15})?(?:phone.{0,5})(?:number|\bnum\b|#|line)|(?:share|send).{0,25}preferred.{0,15}(?:text.?enabled.{0,15})?(?:number|\bnum\b|#|line)|(?:share|send|provide).{0,25}preferred.{0,25}(?:contact|communication).{0,15}(?:method|info|means|way)|(?:direct|preferred).{0,15}line.{0,15}(?:for|to|via).{0,10}(?:text|call|reach|contact|sms)|have.{0,15}preferred.{0,10}number|(?:share|send|provide).{0,25}way.{0,25}(?:reach|contact).{0,25}(?:call|text|sms|whatsapp)'
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("bec", "advance_fee") and .confidence != "low"
  )
  or (
    // confidence can be low on very short bodies
    length(body.current_thread.text) < 550
    and (
      any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")
      or any(ml.nlu_classifier(sender.display_name).intents, .name == "bec")
      or any(ml.nlu_classifier(body.current_thread.text).entities,
             strings.icontains(.text, "kindly")
      )
    )
  )
)
and (
  (
    (length(headers.references) > 0 or headers.in_reply_to is null)
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "RES:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject,
                        '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
        )
      )
    )
  )
  or length(headers.references) == 0
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign

type.inbound
and 0 < length(body.previous_threads) < 3
and length(attachments) == 0
// Check previous_threads for mobile solicitation patterns
and any(body.previous_threads,
        (
          length(.text) < 500
          // ignore disclaimers in body length calculation
          or (
            any(map(filter(ml.nlu_classifier(.text).entities,
                           .name == "disclaimer"
                    ),
                    .text
                ),
                (length(..text) - length(.)) < 500
            )
          )
        )
        and regex.icontains(.text,
                            '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(?:phone|number|#|\bno)|personal\s?(?:phone|cell|number|#)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact|(?:share|send|confirm).{0,20}number.{0,25}(?:text|sms|whatsapp|contact|reach\syou[\s,.\?](?:by|whether|when|for))|best\s+(?:number|#).{0,10}(?:text|sms|contact|call|message|in[-\s]?touch|to\suse)|best\s+way.{0,25}(?:reach|contact).{0,25}(?:text|sms|whatsapp|call|message)'
        )
)

// NLU analysis on previous_threads content
and (
  any(body.previous_threads,
      any(ml.nlu_classifier(.text).intents,
          .name in ("bec", "advance_fee") and .confidence in ("medium", "high")
      )
  )
  or (
    // confidence can be low on very short bodies
    any(body.previous_threads, length(.text) < 550)
    and (
      any(body.previous_threads,
          any(ml.nlu_classifier(.text).intents, .name == "bec")
      )
      or any(ml.nlu_classifier(sender.display_name).intents, .name == "bec")
      or any(body.previous_threads,
             any(ml.nlu_classifier(.text).entities,
                 strings.icontains(.text, "kindly")
             )
      )
    )
  )
)
// Sender analysis
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign
// not high trust sender domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// Ensure this is likely a hijacked thread (sender doesn't match thread participants)
and (length(headers.references) > 0 or headers.in_reply_to is not null)