Sublime MQL rules: brand

type.inbound
and regex.icontains(body.current_thread.text, 'PayApp\s?#\d+')
and regex.icontains(body.current_thread.text, '[a-z0-9\.\+\-]+@[a-z0-9\-]+\.')
and strings.icontains(subject.base, "payapp")

type.inbound
and (
  (
    strings.icontains(sender.display_name, "AARP")
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name in ("request", "financial")
            and regex.icontains(.text, "(?:gift|win|free|renewal)")
    )
  )
  or 2 of (
    strings.icontains(body.current_thread.text, 'AARP'),
    strings.icontains(body.current_thread.text, '601 E Street NW'),
    strings.icontains(body.current_thread.text, 'Washington, DC 20049')
  )
  or (
    strings.icontains(body.current_thread.text, 'AARP')
    and (
      regex.icontains(body.current_thread.text,
                      'quick .{0,10}survey',
                      '\bAAR-[A-Za-z0-9]{5,10}-[A-Za-z0-9]{3,8}' // member number regex
      )
      or strings.icontains(body.current_thread.text,
                           "last attempt",
                           "renewal is complete",
                           "select membership item"
      )
    )
  )
  //
  // This rule makes use of a beta feature and is subject to change without notice
  // using the beta feature in custom rules is not suggested until it has been formally released
  //
  or (
    strings.icontains(beta.ocr(file.message_screenshot()).text, "AARP")
    and strings.icontains(beta.ocr(file.message_screenshot()).text,
                          "join or renew now"
    )
    and strings.icontains(beta.ocr(file.message_screenshot()).text,
                          "to opt out"
    )
  )
)
// negate job postings related to AARP and newsletters containing AARP
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Professional and Career Development",
              "Newsletters and Digests"
            )
            and .confidence == "high"
)
// and the sender is not in org_domains or from AARP domains and passes auth
and not (
  sender.email.domain.root_domain in $org_domains
  or (
    sender.email.domain.root_domain in (
      "aarp.org",
      "proofpointessentials.com",
      "expedia.com",
      "eventbrite.com",
      "zixcorp.com"
    )
    and headers.auth_summary.dmarc.pass
  )
)

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        (
          any(ml.logo_detect(.).brands, .name == "Adobe")
          or strings.icontains(beta.ocr(.).text,
                               'Powered by Adobe Acrobat Sign'
          )
          or strings.icontains(beta.ocr(.).text, 'Adobe Acrobat Sign')
        )
        and strings.icontains(beta.ocr(.).text, 'File Format: PDF')
)

type.inbound
and (
  (
    length(filter(attachments, .file_type == "pdf")) == 0
    and (
      regex.icontains(body.html.raw,
                      'alt="Adobe(?: Acrobat)? Sign"',
                      "adobe-sign-logo.{0,20}.png",
                      'alt="Powered by Adobe Acrobat Sign"'
      )
      or any(html.xpath(body.html, "//img/@src").nodes,
             strings.parse_url(.raw).domain.root_domain == "adobesign.com"
             and (
               strings.istarts_with(strings.parse_url(.raw).path,
                                    "/cobrand_logo/"
               )
               or strings.icontains(strings.parse_url(.raw).path,
                                    "checkmarkCircle"
               )
             )
      )
    )
  )
  or (
    any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                any(.scan.url.urls,
                    regex.icontains(.url,
                                    '(?:ad0be.{0,5}s[1i]gn|ad[0o]be.{0,5}s1gn)'
                    )
                )
        )
    )
  )
)
and not (
  // inspect the "oldest" thread, negate where that thread is the original Adobe Sign email (based on link domains)
  (
    length(body.previous_threads[length(body.previous_threads) - 1].links) > 0
    and all(body.previous_threads[length(body.previous_threads) - 1].links,
            .href_url.domain.root_domain in (
              "aka.ms",
              "adobe.com",
              "adobesign.com",
              "echosign.com",
              "adobesignsandbox.com",
              "mimecastprotect.com",
              "mimecast.com"
            )
            or .href_url.domain.root_domain in $org_domains
            or .href_url.domain.root_domain == sender.email.domain.root_domain
            or any(recipients.to,
                   .email.domain.root_domain == ..href_url.domain.root_domain
            )
    )
  )
  // legit review button
  or any(body.links,
         .display_text in (
           "Review and sign",
           "the document",
           "Open agreement",
           "VIEW DOCUMENTS",
           "Click here to review and sign"
         )
         and (
           .href_url.domain.root_domain in (
             "adobe.com",
             "adobesign.com",
             "echosign.com",
             "adobesignsandbox.com",
           )
           // Mimecast link logic
           or (
             .href_url.domain.root_domain in (
               "mimecastprotect.com",
               "mimecast.com"
             )
             and any(.href_url.query_params_decoded['domain'],
                     strings.parse_domain(.).root_domain in (
                       "adobe.com",
                       "adobesign.com",
                       "echosign.com",
                       "adobesignsandbox.com",
                     )
             )
           )
         )
  )
  // accidental recipient
  or any(recipients.to, .email.email == "adobesign@adobesign.com")
  // known Adobe Sign messaage ID formats
  or (
    (length(headers.references) > 1 or length(body.previous_threads) != 0)
    and regex.imatch(headers.references[0],
                     '[0-9]{9,10}\.[0-9]{4,6}\.[0-9]{13}@event-consumer-prod-[a-z]-[a-z0-9]{7,10}-[a-z0-9]{5}',
                     '[0-9]{8,10}\.[0-9]{5,7}\.[0-9]{13}@(webapp|job)-prod-.*$',
                     '[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}-APO-PRODHIPAA@apo-p-h'
    )
  )
  // negate Adobe Sign messages from custom domains
  or any(headers.hops,
         any(.fields, .name in ("Adobesigneventid", "Agreementid"))
  )
)
and not (
  sender.email.domain.root_domain in (
    "adobe.com",
    "adobesign.com",
    "adobesignsandbox.com",
    "echosign.com",
    // ticketing software that embeds emails
    "helpscout.net"
  )
  and headers.auth_summary.dmarc.pass
)
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and (
  // the address in the footer
  strings.icontains(body.current_thread.text,
                    '26/F Tower One, Times Square, 1 Matheson Street, Causeway Bay'
  )
  // the social links in the footer
  or (
    length(filter(body.links,
                  strings.icontains(.href_url.url,
                                    'https://www.facebook.com/aliexpressbr'
                  )
                  or strings.icontains(.href_url.url,
                                       'https://twitter.com/aliexpressbr'
                  )
                  or strings.icontains(.href_url.url,
                                       'https://www.youtube.com/user/AliExpressChannel'
                  )
                  or strings.icontains(.href_url.url,
                                       'https://www.instagram.com/aliexpressbr'
                  )
                  // whatsapp
                  or strings.icontains(.href_url.url,
                                       'https://wa.me/8657186563839'
                  )
                  // messenger
                  or strings.icontains(.href_url.url, 'https://m.me/AliExpress')
           )
    ) >= 4
  )
)
// not from AliExpress or Alibaba
and not (
  sender.email.domain.root_domain in ("aliexpress.com", "alibaba.com")
  and headers.auth_summary.dmarc.pass
)
// did not traverse the parent org's mail server
and not (any(headers.domains, .root_domain in ('aliyun-inc.com')))

type.inbound
and regex.icontains(strings.replace_confusables(sender.display_name),
                    '\baws\b|amazon web services|\bses\b'
)
and (
  // ML Topic Analysis and Credential Theft Detection
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in ("Security and Authentication", "Secure Message")
      and .confidence == "high"
  )
  or (
    beta.ocr(file.message_screenshot()).text != ""
    and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
            .name in ("Security and Authentication", "Secure Message")
            and .confidence == "high"
    )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "cred_theft" and .confidence == "high"
  )
  or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
         .name == "cred_theft" and .confidence == "high"
  )
)
// Not from legitimate AWS domains
// there was a DMARC check here, but a lot of users send AWS notifications to groups/mailing lists that breaks DMARC
and not (
  sender.email.domain.root_domain in $org_domains
  or sender.email.domain.root_domain in (
    "amazon.com",
    "amazonaws.com",
    "amazonses.com",
    "awsevents.com",
    "awsmp-seller-conference.com",
    "aws-experience.com",
    "marketplace.aws",
    "aws.com",
    "amazonaws.cn",
    "repost.aws",
    "awscustomercouncil.com",
    "airtableemail.com", // used for re:Invent
    "nmls.org", // "state examination system", realtor software
    "mktgcampaigns.com", // Elastic + AWS co-marketing emails
    "awseducate.com",
    "awsacademy.com"
  )
  or sender.email.domain.tld == "local"
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// sender email specific
and not (
  profile.by_sender_email().solicited
  // sender domain specific
  or (
    profile.by_sender().solicited
    // 30 day decay
    and (profile.by_sender().days_since.last_contact < 30)
  )
)

type.inbound
and (
  regex.icontains(sender.display_name, 'Aquent\b')
  // look for Aquent address from footer, or current address being used by actors
  or (
    strings.icontains(body.current_thread.text, 'Aquent')
    and (
      (
        strings.icontains(body.current_thread.text, '2884 Sand Hill Road')
        and strings.icontains(body.current_thread.text, 'Menlo Park, CA 94025')
      )
      or (
        strings.icontains(body.current_thread.text, '501 Boylston St')
        and strings.icontains(body.current_thread.text, 'Boston, MA 02116')
      )
    )
  )
)
and not (
  sender.email.domain.root_domain in $org_domains
  or (
    sender.email.domain.root_domain in (
      "aquent.com",
      "dice.com",
      "roberthalf.com",
      "roberthalf.be",
      "service-now.com",
      "protiviti.com",
      "atlassian.net",
      "workday.com",
      "myworkday.com",
      "rapdev.io",
      "immersivelabs.com",
      "outsidegc.com"
    )
    and headers.auth_summary.dmarc.pass
  )
)
// not a forward or reply
and (headers.in_reply_to is null or length(headers.references) == 0)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Advertising and Promotions" and .confidence != "low"
)
// negate instances where proofpoint sends a review of a reported message via analyzer 
and not (
  sender.email.email == "analyzer@analyzer.securityeducation.com"
  and any(headers.domains, .root_domain == "pphosted.com")
  and headers.auth_summary.spf.pass
  and headers.auth_summary.dmarc.pass
)

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("org", "sender")
        and regex.contains(.text, '\b(?:AAA|RAC|RAA|CAA|BCAA|AMA)\b')
)
and regex.icontains(body.current_thread.text,
                    '(?:car|vehicle|motor|driver|emergency|road.?side|break.?down|assist|save|discount|complimentary|free\b).{0,10}kit'
)
// and the sender is not from high trust sender root domains
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate newsletters and quarantine notifications
and not (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in ("Newsletters and Digests") and .confidence != "low"
  )
  or strings.icontains(subject.subject, "quarantine")
)

type.inbound
// self sender or invaild recipent domain
and length(recipients.to) == 1
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        .href_url.domain.root_domain != 'bidsandtenders.ca'
        and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                .domain.domain == 'bids.bidsandtenders.ca'
                and strings.icontains(.path, '/Logo/')
        )
)

type.inbound
and length(body.links) < 10
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in (
        "Travel and Transportation",
        "Customer Service and Support",
        "Security and Authentication"
      )
      and .confidence != "low"
  )
  // handle instances in which ml_topic does not hit
  or (
    length(body.links) == 0
    and length(attachments) == 0
    and length(body.current_thread.text) < 1000
    and strings.icontains(sender.display_name, "booking.com")
  )
)
and (
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "org" and .text == "Booking.com"
  )
  or strings.icontains(body.current_thread.text, ' booking.com ')
  or strings.icontains(sender.display_name, "booking.com")
  or 2 of (
    strings.icontains(body.current_thread.text, "Booking.com"),
    strings.icontains(body.current_thread.text, "Oosterdokskade 163"),
    strings.icontains(body.current_thread.text, "Amsterdam")
  )
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft"
  )
  or any(body.links,
         strings.ilike(.display_text,
                       "*review*",
                       "*response*",
                       "*respond*",
                       "*complaint*",
                       "*contact*",
                       "*accommodation*",
                       "*view*details*"
         )
         or .display_url.domain.root_domain == "booking.com" and .mismatched
         or .href_url.domain.root_domain == 'share.google'
         or network.whois(.href_url.domain).days_old < 30
         or strings.icontains(.href_url.path, "/redir")
  )
  // check for text strings that betray intent
  or regex.icontains(body.current_thread.text, '(?:book\sa|open)\srooms', )
  or strings.ilike(body.current_thread.text, "* availab*", )
  // two seperate HTML elements impersonating the logo
  or (
    any(html.xpath(body.html, '//*[text()[normalize-space()]]').nodes,
        .display_text =~ "Booking"
    )
    and any(html.xpath(body.html, '//*[text()[normalize-space()]]').nodes,
            .display_text =~ ".com"
    )
  )
)
and not (
  sender.email.domain.root_domain in~ (
    'booking.com',
    'siteminder.com',
    'thinkreservations.com'
  )
  and headers.auth_summary.dmarc.pass
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate microsoft quarantine messages
and not (
  sender.email.email == "quarantine@messaging.microsoft.com"
  and (
    headers.auth_summary.dmarc.pass
    // no sender auth but MS AuthAs is Internal
    or (
      not coalesce(headers.auth_summary.dmarc.pass, false)
      and any(headers.hops,
              .index == 0
              and any(.fields,
                      .name == "X-MS-Exchange-CrossTenant-AuthAs"
                      and .value == "Internal"
              )
      )
    )
  )
)

type.inbound
and (
  // display name contains Disney
  (
    (
      strings.ilike(strings.replace_confusables(sender.display_name),
                    '*disney*'
      )
      and not strings.ilike(strings.replace_confusables(sender.display_name),
                            '*disney springs*'
      )
    )
    // levenshtein distance similar to Disney
    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                            'disney'
    ) <= 1
    or any(ml.logo_detect(file.message_screenshot()).brands,
           .name == "Disney" and .confidence == "high"
    )
  )
)
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Security and Authentication",
          "Secure Message",
          "Reminders and Notifications"
        )
        and .confidence in ("medium", "high")
    )
    and not any(ml.nlu_classifier(body.current_thread.text).topics,
                .name in ("Newsletters and Digests", "Entertainment and Sports")
                and .confidence in ("medium", "high")
    )
  )
  or (
    beta.ocr(file.message_screenshot()).text != ""
    and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
            .name in (
              "Security and Authentication",
              "Secure Message",
              "Reminders and Notifications"
            )
            and .confidence in ("medium", "high")
    )
    and not any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
                .name in ("Newsletters and Digests", "Entertainment and Sports")
                and .confidence in ("medium", "high")
    )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "cred_theft" and .confidence == "high"
  )
  or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
         .name == "cred_theft" and .confidence == "high"
  )
)

// and the sender is not in org_domains or from Disney domains and passes auth
and not (
  sender.email.domain.root_domain in $org_domains
  or (
    // from https://github.com/v2fly/domain-list-community/blob/master/data/disney
    sender.email.domain.root_domain in (
      "disney.asia",
      "disney.be",
      "disney.bg",
      "disney.ca",
      "disney.ch",
      "disney.co.il",
      "disney.co.jp",
      "disney.co.kr",
      "disney.co.th",
      "disney.co.uk",
      "disney.co.za",
      "disney.com",
      "disney.com.au",
      "disney.com.br",
      "disney.com.hk",
      "disney.com.tw",
      "disney.cz",
      "disney.de",
      "disney.dk",
      "disney.es",
      "disney.fi",
      "disney.fr",
      "disney.gr",
      "disney.hu",
      "disney.id",
      "disney.in",
      "disney.io",
      "disney.it",
      "disney.my",
      "disney.nl",
      "disney.no",
      "disney.ph",
      "disney.pl",
      "disney.pt",
      "disney.ro",
      "disney.ru",
      "disney.se",
      "disney.sg",
      "disneysurveys.com",
      "disneyonline.com",
      "disneyaccount.com",
      "disneyadvertising.com",
      "disneydestinations.com",
      "hulu.com",
      "hulumail.com",
      "canarytechnologies.com", // domain used by a disney resort - hotel mgmt software company
      "disneyvacationclub.com",
      "twdc.com",
      "disneyrewards.com",
      "disneystore.com",
      "disneyworld.com"
    )
    and headers.auth_summary.dmarc.pass
  )
)
// and the sender is not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or not headers.auth_summary.dmarc.pass
  or not headers.auth_summary.spf.pass
)

type.inbound
and (
  (
    sender.display_name =~ 'DocSend'
    or strings.ilevenshtein(sender.display_name, 'DocSend') <= 1
    or strings.icontains(sender.email.domain.domain, '*docsend*')
    or regex.icontains(body.current_thread.text, 'on Dropbox\s*(?:Doc)?\s*Send')
    or regex.icontains(body.current_thread.text,
                       'The Dropbox\s*(?:Doc)?\s*Send Team'
    )
    or regex.icontains(body.current_thread.text,
                       'Report to Dropbox\s*(?:Doc)?\s*Send'
    )
    or regex.icontains(body.current_thread.text,
                       '©\s*20[0-9]{2}\s*,\s*Dropbox DocSend'
    )
    or any(ml.nlu_classifier(body.current_thread.text).entities,
           .name in ("sender", "org")
           and strings.icontains(.text, 'Dropbox DocSend')
    )
  )
)
and not (
  sender.email.domain.root_domain in~ ('docsend.com')
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender_email().solicited

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(ml.logo_detect(.).brands, .name == "DocuSign")
        and any(file.explode(.),
                length(.scan.url.urls) <= 9
                and any(.scan.url.urls,
                        .domain.root_domain not in $tranco_1m
                        and .domain.root_domain not in $org_domains
                        and .domain.root_domain != "sublimesecurity.com"
                        and not strings.ilike(.domain.root_domain, "docusign.*")
                )
        )
        and any(file.explode(.),
                any(ml.nlu_classifier(.scan.ocr.raw).entities,
                    .name == "org" and .text == "DocuSign"
                )
        )
        and any(file.explode(.),
                any(ml.nlu_classifier(.scan.ocr.raw).entities,
                    .name == "request"
                )
        )
)

type.inbound
and length(body.current_thread.text) < 1000
and length(attachments) == 0
and regex.icontains(body.current_thread.text, '\bQ(\.)?R(\.)?\b')
and regex.icontains(body.current_thread.text, "scan|mobile|camera")
and any(ml.logo_detect(file.message_screenshot()).brands,
        strings.starts_with(.name, "DocuSign")
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(beta.scan_qr(file.message_screenshot()).items,
        .type is not null and regex.contains(.data, '\.')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and (
  strings.ilike(sender.display_name, '*enbridge*')
  or strings.ilike(sender.email.domain.domain, '*enbridge*')
  or strings.ilike(subject.subject, '*enbridge*')
)
and any(body.links,
        strings.ilike(.display_text, "*pay now*", "*view your bill*")
)
// negate replies
and (length(headers.references) == 0 or headers.in_reply_to is null)
and sender.email.domain.root_domain not in~ (
  'enbridge.com',
  'enbridgegas.com',
  // Enbridge Subsidiaries
  'domenergyoheb.com', // Dominion Energy Ohio
  'domenergyuteb.com' // Dominion Energy Utah
)