Sublime MQL rules: credential

type.inbound
and length(attachments) == 0
and (
  0 < length(body.links) < 10
  // ignore link count when the HTML is padded with whitespace
  // indicative of thread hijacking/copy-pasting
  or regex.icount(body.html.raw, '(<br\s*/?>[\s\n]*)') > 50
)
and (
  regex.icontains(body.html.raw, '<font size="[0-9]">DocuSign</font>')
  or regex.icontains(body.html.raw, '<span[^>]*style="[^"]*">DocuSign<\/span>')
  or regex.icontains(body.html.raw, '<strong>DocuSign</strong>')
  or regex.icontains(body.html.raw,
                     'D&#917540;&#917540;o&#917540;&#917540;c\x{FE00}uS&#917540;&#917540;i\x{FE00}gn'
  )
  or any(body.links, regex.icontains(.display_text, 'view.{0,3}doc'))
  or any(body.links, regex.contains(.display_text, '\bDOCUMENT'))
)
and (
  regex.icontains(body.html.raw, 'background:\s*rgb\(30,\s*76,\s*161\)')
  or regex.icontains(body.html.raw,
                     'background-color:\s*rgb\(30,\s*76,\s*161\)'
  )
  or regex.icontains(body.html.raw,
                     'background-color:\s*rgb\(61,\s*170,\s*73\)'
  )
  or regex.icontains(body.html.raw,
                     '<div[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>|<td[^>]*BACKGROUND-COLOR: #1e4ca1[^>]*>'
  )
  or regex.icontains(body.html.raw, 'background-color:#214e9f;')
  or regex.icontains(body.html.raw, 'background-color:#3260a7')
  or regex.icontains(body.html.raw,
                     '<table[^>]*cellspacing="0"[^>]*cellpadding="0"[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*<td[^>]*style="BACKGROUND:\s*rgb\(247,247,247\);\s*width:\s*[0-9]{2,3}px;\s*padding:20px;\s*margin:\s*[0-9]{2,3}px"[^>]*>.*<div[^>]*style="BACKGROUND:\s*rgb\(30,76,161\);\s*padding:[0-9]{2,3}px;\s*color:#EFEFEF"[^>]*align="center"[^>]*>.*DOCUMENT.*</a>'
  )
  // Docusign Blue Box template with button
  or (
    regex.icontains(body.html.raw,
                    '<(td|div)[^>]*style="[^"]*background(-color)?:\s*(#1e4ca1|rgb\(30,\s*76,\s*161\))[^"]*"[^>]*>'
    )
    and (
      regex.icontains(body.html.raw,
                      '<a[^>]*style="[^"]*background-color:\s*(#[A-Fa-f0-9]{6}|rgb\([^)]*\))[^"]*"[^>]*>.*?<span[^>]*>.*?<\/span>.*?<\/a>'
      )
      // white link with a border
      or (
        regex.icontains(body.html.raw,
                        '<a[^>]*style="[^"]*color:\s*(white|#fff|#ffffff|#FFF|#FFFFFF|rgb\(\s*255\s*,\s*255\s*,\s*255\s*\)|rgba\(\s*255\s*,\s*255\s*,\s*255\s*,\s*[0-9.]+\s*\)|rgb\(\s*100%\s*,\s*100%\s*,\s*100%\s*\))[^"]*"[^>]*>.*?<\/a>'
        )
        and regex.icontains(body.html.raw,
                            '<a[^>]*style="[^"]*border:[^"]*"[^>]*>.*?<\/a>'
        )
      )
    )
  )
)
and any(body.links,
        not strings.ilike(.href_url.domain.root_domain, "docusign.*")
        and (
          .display_text is null or regex.contains(.display_text, '\bDOCUMENT')
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// negate legit replies
and not (length(headers.references) > 0 or headers.in_reply_to is not null)
and not profile.by_sender().any_messages_benign

// negate docusign X-Return-Path
and not any(headers.hops,
            .index == 0
            and any(.fields,
                    .name == "X-Return-Path"
                    and strings.ends_with(.value, "docusign.net")
            )
)

type.inbound
and (
  0 < length(body.current_thread.links) < 10
  or length(body.current_thread.links) > 100
)
and any([subject.subject, sender.display_name],
        regex.icontains(.,
                        "(?:cloud|storage|mailbox|account|system|service|^data)"
        )
)
and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
        .name == "cred_theft" and .confidence == "high"
)
and not any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
            .name == "Customer Service and Support" and .confidence == "high"
)
and regex.icontains(beta.ocr(file.message_screenshot()).text,
                    "storage.{0,50}full",
                    "free.{0,50}upgrade",
                    "storage.{0,50}details",
                    "storage.{0,50}quot",
                    "(?:mailbox|account|cloud).{0,50}(?:at risk|storage|disabled)",
                    '\d{2}%\s*capacity',
                    "data.{0,20}(?:removal|purge|protection mode)",
                    "billing.{0,20}suspended"
)
and not strings.ilike(beta.ocr(file.message_screenshot()).text, "*free plan*")
and (
  any(body.current_thread.links,
      // fingerprints of a hyperlinked image
      .display_text is null
      and .display_url.url is null
      and .href_url.domain.domain not in $tenant_domains
      and (
        .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.root_domain in $url_shorteners
        or network.whois(.href_url.domain).days_old < 365
        or .href_url.domain.root_domain == "beehiiv.com"
        or regex.icontains(.href_url.path, '^\/[a-z0-9]{20,}$')
        or (
          strings.icontains(.href_url.path, '.html')
          and coalesce(.href_url.domain.root_domain, "null") != coalesce(sender.email.domain.root_domain,
                                                                         ""
          )
        )
        or "google_adservices" in .href_url.rewrite.encoders
      )
  )
)
// and the sender is not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and recipients.to[0].email.domain.sld == sender.email.local_part
and any(body.links,
        strings.icontains(.href_url.domain.domain, "lambda-url")
        and strings.icontains(.href_url.fragment, recipients.to[0].email.email)
)

type.inbound
and (
  strings.icontains(body.current_thread.text, "btc", "bitcoin")
  or regex.icontains(body.current_thread.text, 'pass[\s-]?word')
)
and 2 of (
  strings.icontains(body.current_thread.text, "portfolio"),
  strings.icontains(body.current_thread.text, "confirm your balance"),
  strings.icontains(body.current_thread.text, "web portal"),
  strings.icontains(body.current_thread.text, "customer id"),
  strings.icontains(body.current_thread.text, "login to confirm")
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "advance_fee", "bec")
)
// and the sender is not from high trust sender root domains
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
// link boundary
and length(filter(body.links, .href_url.domain.valid)) < 25

// there are no attachments, or only small, likely signature images
and (
  length(attachments) == 0
  or (
    length(attachments) > 0
    and all(attachments, .size < 8000 and .file_type in $file_types_images)
  )
)

// Screenshot indicates a docusign logo or docusign name with cta to documents
and (
  (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    strings.ilike(beta.ocr(file.message_screenshot()).text, "*DocuSign*")
    or any(ml.logo_detect(file.message_screenshot()).brands,
           .name == "DocuSign"
    )
  )
  and (
    (
      (
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        regex.icontains(beta.ocr(file.message_screenshot()).text,
                        "((re)?view|access|sign|complete(d)?) documen(t)?(s)?",
                        "Your document has been completed",
                        "New Document Shared with you",
                        "Kindly click the link",
                        "important edocs",
                        // German (Document (check|check|sign|sent))
                        "Dokument (überprüfen|prüfen|unterschreiben|geschickt)",
        )
        // German (important|urgent|immediate) but not in the Microsoft link
        or (
          (
            any(body.links,
                .display_text == "Erfahren Sie, warum dies wichtig ist"
                and .href_url.url == "https://aka.ms/LearnAboutSenderIdentification"
            )
            and regex.icount(beta.ocr(file.message_screenshot()).text,
                             "(wichtig|dringend|sofort)"
            ) > 1
          )
          or (
            not any(body.links,
                    .display_text == "Erfahren Sie, warum dies wichtig ist"
                    and .href_url.url == "https://aka.ms/LearnAboutSenderIdentification"
            )
            and regex.icount(beta.ocr(file.message_screenshot()).text,
                             "(wichtig|dringend|sofort)"
            ) > 0
          )
        )
      )
      and any(body.links,
              not strings.ilike(.href_url.domain.root_domain, "docusign.*")
              and (.display_text is null and .display_url.url is null)
      )
    )
    or any(body.links,
           not strings.ilike(.href_url.domain.root_domain, "docusign.*")
           and (
             regex.icontains(strings.replace_confusables(.display_text),
                             '(\bdocument|(view|get your) (docu|file))'
             )
             or strings.icontains(.display_text,
                                  "R\u{200F}E\u{200F}V\u{200F}I\u{200F}E\u{200F}W\u{200F} \u{200F}D\u{200F}O\u{200F}C\u{200F}U\u{200F}M\u{200F}E\u{200F}N\u{200F}T\u{200F}"
             )
           )
    )
  )
)

// links with null display_text that do not go to docusign.* (indicative of hyperlinked image) or the display text contains DOCUMENT
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// negate legit replies
and not (length(headers.references) > 0 or headers.in_reply_to is not null)
and not profile.by_sender().any_messages_benign

// negate docusign X-Return-Path
and not any(headers.hops,
            .index == 0
            and any(.fields,
                    .name == "X-Return-Path"
                    and strings.ends_with(.value, "docusign.net")
            )
)

// negate "via" senders via dmarc authentication
and (
  not coalesce(headers.auth_summary.dmarc.pass
               and strings.contains(sender.display_name, "via")
               and sender.email.domain.domain in $org_domains,
               false
  )
)

type.inbound
and length(body.links) < 10
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  or (
    length(body.current_thread.text) < 250
    and any(recipients.to,
            strings.icontains(body.current_thread.text, .email.domain.sld)
            or strings.icontains(body.current_thread.text, .email.local_part)
    )
  )
)
and (
  regex.icontains(subject.subject, '(e)?mail(s)?')
  or (
    length(body.current_thread.text) < 700
    and strings.ilike(body.current_thread.text, '*mail*')
  )
)
and 3 of (
  strings.ilike(body.current_thread.text, "*incoming messages*"),
  strings.ilike(body.current_thread.text, "*server error*"),
  strings.ilike(body.current_thread.text, "*blocked*"),
  strings.ilike(body.current_thread.text, "*prevented*"),
  strings.ilike(body.current_thread.text, "*notification*"),
  strings.ilike(body.current_thread.text, "*fix email issues*"),
  strings.ilike(body.current_thread.text, "*rejected*"),
  strings.ilike(body.current_thread.text, "*recover and prevent*"),
  strings.ilike(body.current_thread.text, "*failure*"),
  strings.ilike(body.current_thread.text, "*rejection*"),
  strings.ilike(body.current_thread.text, "*failed*")
)
and (
  any(body.links,
      regex.icontains(.display_text,
                      "view",
                      "messages",
                      "recover",
                      "fix",
                      "portal",
                      "connect"
      )
      and not .display_text == "View Report"
      and .href_url.domain.root_domain in ("gmass.co")
  )
  or (
    length(body.links) < 3
    and any(body.links,
            any(recipients.to,
                .email.domain.root_domain == ..display_url.domain.root_domain
                and ..mismatched
            )
    )
  )
  or (all(recipients.to, .email.local_part == sender.display_name))
  or any(body.links,
         any(.href_url.rewrite.encoders, . == "proofpoint")
         and .href_url.domain.root_domain not in $tranco_50k
         and .href_url.domain.root_domain not in $org_domains
  )
)
and not any(body.links,
            regex.icontains(.display_text,
                            "view document",
                            "review (&|and) sign document"
            )
)
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "office365.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com",
  "ppops.net"
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and (
      not headers.auth_summary.dmarc.pass
      // MS  emails from an org domain are router "internally" to MS, therefore, there is no authentication information
      or not (
        headers.auth_summary.dmarc.pass is null
        and all(headers.domains,
                .root_domain in ("outlook.com", "office365.com")
        )
        // typical emails from freemail Outlook accounts are from prod.outlook.com
        and strings.ends_with(headers.message_id, "protection.outlook.com>")
      )
    )
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign

type.inbound
and (
  (
    regex.icontains(subject.base, '\bcard\b')
    or regex.icontains(body.current_thread.text, '\bcard\b')
  )
  and strings.ilike(body.current_thread.text,
                    "*could be with you*",
                    "*currently accessible*",
                    "*collect bank details*",
                    "*not a financial institution*"
  )
)
and any(body.links,
        strings.ilike(.display_text,
                      "*track order*",
                      "*track*card*",
                      "*card status*"
        )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and strings.contains(headers.mailer, "ActiveCampaign")
and (
  strings.ilike(body.html.inner_text,
                "*Piratini*",
                "*45.405.898/0001-16*",
                "*Cancelar inscri*",
                "*Matem?tica Genial*"
  )
  or strings.ilike(body.html.raw,
                   "*belonging to Spun*",
                   "*affiliated with Spun*"
  )
)
and (
  length(html.xpath(body.html,
                    '//*[contains(@style, "background") and contains(@style, "padding")] | //a[contains(@class, "es-button")]'
         ).nodes
  ) > 0
  or length(html.xpath(body.html, '//a/img').nodes) > 0
)
and ml.nlu_classifier(body.current_thread.text).language == "english"
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Health and Wellness", "Entertainment and Sports")
            and .confidence == "high"
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and (
  // nlu capture for wide scope of greetings to reduce evasion
  any(filter(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "greeting"
      ),
      any([
            recipients.to[0].email.domain.sld,
            recipients.to[0].email.local_part,
            recipients.to[0].email.domain.domain,
            // "firstlast" naming convention observed
            strings.concat(mailbox.first_name, mailbox.last_name)
          ],
          // recipient entity follows the greeting in the body text
          strings.icontains(body.current_thread.text,
                            strings.concat(..text, " ", .)
          )
      )
  )
  or (
    // nlu capture for wide scope of greetings to reduce evasion
    any(filter(ml.nlu_classifier(body.current_thread.text).entities,
               .name == "greeting"
        ),
        // nlu capture for wide scope of recipient entity to reduce evasion
        any(filter(ml.nlu_classifier(body.current_thread.text).entities,
                   .name == "recipient"
                   and not (
                     strings.icontains(.text, "customer")
                     // accounting for grouped recipients
                     or regex.icontains(.text, '&|\band\b')
                   )
            ),
            // recipient entity follows the greeting in the body text
            strings.icontains(body.current_thread.text,
                              strings.concat(..text, " ", .text)
            )
            // the named recipient doesn't match the actual "to" recipient
            and not any([
                          recipients.to[0].email.domain.sld,
                          recipients.to[0].email.local_part,
                          recipients.to[0].email.domain.domain,
                          mailbox.first_name,
                        ],
                        strings.icontains(..text, .)
            )
        )
    )
  )
  or any([
           recipients.to[0].email.domain.sld,
           recipients.to[0].email.local_part,
           recipients.to[0].email.domain.domain,
           // "firstlast" naming convention observed
           strings.concat(mailbox.first_name, mailbox.last_name)
         ],
         // strings logic for non-greeting body starter
         strings.icontains(body.current_thread.text,
                           strings.concat("attn: ", .)
         )
         // strings logic for recipient as body starter
         or strings.icontains(body.current_thread.text,
                              strings.concat(., " balance statement")
         )
  )
  // count of all recipient elements is 2 or greater
  or length(filter([
                     recipients.to[0].email.domain.sld,
                     recipients.to[0].email.local_part,
                     recipients.to[0].email.domain.domain,
                     // "firstlast" naming convention observed
                     strings.concat(mailbox.first_name, mailbox.last_name)
                   ],
                   strings.icontains(body.current_thread.text, .)
            )
  ) >= 2

  // logic for broken attack
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "recipient" and regex.icontains(.text, '[{}]')
  )
)

// unicode + keyword generic template
and (
  (
    (
      regex.icontains(body.current_thread.text,
                      '(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})\n?.{0,15}(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)',
                      '(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)\n?.{0,15}(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
      )
      // negate sharepoint paths with unicode
      and not any(body.links,
                  regex.icontains(.display_url.path,
                                  '(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
                  )
      )
    )
    // start of body is unicode & CTA button is present
    or (
      regex.icontains(body.current_thread.text,
                      '^(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
      )
      and any(body.links,
              regex.icontains(.display_text,
                              '(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)'
              )
      )
    )
  )
)

// strings negations
and not regex.icontains(body.current_thread.text,
                        'meeting (?:note|recap)|daily brief|brief recap'
)

// nlu intent negation for FP's
and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")

// nlu topic negations
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Software and App Updates", "B2B Cold Outreach")
)

// negate multiple recipients unless undisclosed recipients
and not (
  length(recipients.to) == 1
  and (
    (length(recipients.cc) != 0 or length(recipients.bcc) != 0)
    // notification automation
    and not any(recipients.bcc, .email.local_part == "notifications")
  )
  and not (
    length(recipients.to) == 0
    or all(recipients.to, .email.domain.valid == false)
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// negate legitimate conversations
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)

// sender negations
and not (
  sender.email.domain.root_domain in (
    "gc.ai",
    "getguru.com",
    "glean.com",
    "mentorloop.com",
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
// exclude if it's a reply to an existing conversation
and (
  not length(body.previous_threads) > 0
  // still match if self-sender BCC pattern
  or (
    length(recipients.to) == 1
    and length(recipients.cc) == 0
    and sender.email.email == recipients.to[0].email.email
  )
)
and (
  // subject contains document sharing language
  regex.icontains(subject.base,
                  '\b(has\s+sent\s+you|sent\s+you|shared\s+with\s+you|document\s+to\s+review|document\s*(number|num|#)|file\s+to\s+review|proposal\s+(?:document|submission)|new\s+document|document\s+.{0,20}(assigned|available)|(complete|review|shared?).{0,20}agreement.{0,20}|document\s+(?:transfer|shared))\b'
  )
  or strings.icontains(subject.subject, 'document to review')
  or strings.icontains(subject.subject, 'file to review')
  or strings.icontains(subject.subject, 'sent you')
  or strings.icontains(subject.subject, 'eDocuments Notification')
  // or recipient's SLD is the subject
  or (
    subject.base == sender.email.domain.sld
    // account for near-matches
    or (
      length(subject.base) < length(sender.email.domain.sld)
      and any([subject.base], strings.icontains(sender.email.domain.sld, .))
    )
  )
  // blank subject with recipient SLD in message body
  or (
    (length(subject.base) == 0 or subject.base is null)
    and any(recipients.to,
            strings.istarts_with(body.current_thread.text, .email.domain.sld)
    )
  )
)
and (
  // body contains document sharing language
  regex.icontains(body.current_thread.text,
                  '\b(?:document\s+I\s+sent|proposal\s+document|(?:proposal|documents?)\s+for\s+your\s+(?:approval|consideration|review|signature)|see\s+the\s+below|document.*(?:review|posted)|file.*review|let\s+me\s+know\s+what\s+you\s+think|shared.{0,50}document|(?:review\s+and\s+)?sign\s+your\s+document|electronic\s+signature\s+required)\b'
  )
  or strings.icontains(body.current_thread.text, 'document I sent')
  or strings.icontains(body.current_thread.text, 'proposal document')
  or strings.icontains(body.current_thread.text, 'let me know what you think')
  // account for image-as-content
  or (
    length(body.current_thread.text) < 10
    and (
      regex.icontains(beta.ocr(file.message_screenshot()).text,
                      '\b(document\s+I\s+sent|proposal\s+document|see\s+the\s+below|document.*review|file.*review|let\s+me\s+know\s+what\s+you\s+think|shared.{0,50}document)\b'
      )
      or strings.icontains(beta.ocr(file.message_screenshot()).text,
                           'document I sent'
      )
      or strings.icontains(beta.ocr(file.message_screenshot()).text,
                           'proposal document'
      )
      or strings.icontains(beta.ocr(file.message_screenshot()).text,
                           'let me know what you think'
      )
    )
  )
)
// has links that look like file attachments but aren't
and any(filter(body.links,
               // display text looks like a file
               (
                 regex.icontains(.display_text,
                                 '\.(pdf|doc|docx|goto|xls|xlsx|ppt|pptx)'
                 )
                 or regex.icontains(.display_text, '\d+kb|\d+mb')
                 or strings.icontains(.display_text, 'document')
                 or strings.icontains(.display_text, 'proposal')
                 or strings.icontains(.display_text, 'review')
                 // account for image-as-content
                 or (
                   length(body.current_thread.text) < 10
                   and length(body.links) == 1
                 )
               )
               // but the URL doesn't point to legitimate file sharing
               and .href_url.domain.root_domain not in (
                 "sharepoint.com",
                 "google.com",
                 "dropbox.com",
                 "box.com",
                 "onedrive.com",
                 "1drv.ms",
                 "aka.ms",
                 "microsoft.com",
                 "office.com",
                 "docusign.com",
                 "adobesign.com",
                 "hellosign.com",
                 "signable.app"
               )
               and .href_url.domain.domain not in ("drive.google.com")
        ),
        // and points to suspicious domains
        .href_url.domain.tld in $suspicious_tlds
        or .href_url.domain.root_domain in $url_shorteners
        or .href_url.domain.domain in $url_shorteners
        or .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.domain in $free_file_hosts
        // or it's a forms/survey platform being abused in self_service_creation_platform_domains
        or .href_url.domain.root_domain in $self_service_creation_platform_domains
        or .href_url.domain.domain in $self_service_creation_platform_domains
        // bulk mailer abuse has been observed
        or (
          (
            .href_url.domain.root_domain in $bulk_mailer_url_root_domains
            or (
              .href_url.rewrite.original is not null
              and 'mandrill' in .href_url.rewrite.encoders
            )
          )
          and .href_url.domain.sld not in $org_slds
        )
        // or the page redirects to common website, observed when evasion happens
        or (
          length(ml.link_analysis(., mode="aggressive").redirect_history) > 0
          and ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in $tranco_10k
        )
        // or common email marketing/tracking patterns
        or regex.match(.href_url.url, 'url\d+\..*\.com/ls/click')
        or regex.match(.href_url.path, '/ls/click|/click|/c/')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  profile.by_sender().solicited == false
  or profile.by_sender_email().prevalence == "new"
  or profile.by_sender_email().days_since.last_contact > 30
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
  // or it's a spoof of the org_domain
  or (
    sender.email.domain.domain in $org_domains
    and not (
      headers.auth_summary.spf.pass
      or coalesce(headers.auth_summary.dmarc.pass, false)
    )
  )
)
and not profile.by_sender().any_messages_benign

type.inbound
and length(body.links) > 0
and 0 < length(attachments) < 8
and all(attachments, .file_type in $file_types_images and .size > 2000)
and any(body.links,
        // fingerprints of a hyperlinked image
        .display_text is null
        and .display_url.url is null
        and .href_url.domain.root_domain in $free_file_hosts
)
and (
  // body text is very short
  (
    0 <= (length(body.current_thread.text)) < 10
    or body.current_thread.text is null
  )
  or (
    length(body.current_thread.text) < 900
    // or body is most likely all warning banner (text contains the sender and common warning banner language)
    and (
      (
        strings.contains(body.current_thread.text, sender.email.email)
        and strings.contains(body.current_thread.text, 'caution')
      )
      or regex.icontains(body.current_thread.text,
                         "intended recipient's use only|external email|sent from outside|you don't often|confidential"
      )
    )
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// not solicited or previously flagged malicious/spam
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)

// negate legitimate canva emails
and not (
  strings.contains(sender.display_name, "via Canva")
  and sender.email.domain.domain == "canva.com"
  and (
    any(distinct(headers.hops, .authentication_results.dmarc is not null),
        strings.ilike(.authentication_results.dmarc, "*pass")
    )
  )
)