Sublime MQL rules: deceptive

type.inbound
and strings.icontains(body.current_thread.text, 'dropbox')
and any(beta.ml_topic(coalesce(body.html.display_text, body.current_thread.text)
        ).topics,
        .name == "File Sharing and Cloud Services" and .confidence != "low"
)
and (
  // Email address discrepancy detection - looking for matches in the domain name from the sender but not the current thread proposed sender name
  any(regex.iextract(body.current_thread.text,
                     '(?P<whole_email>(?P<local_part>[a-zA-Z0-9._%-]+)@(?P<domain_name>[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}))'
      ),
      strings.parse_email(.named_groups["whole_email"]).domain.domain == sender.email.domain.domain
      and strings.parse_email(.named_groups["whole_email"]).local_part != sender.email.local_part
      and not strings.parse_email(.named_groups["whole_email"]).email in~ map(filter(recipients.to,
                                                                                     .email.domain.valid
                                                                              ),
                                                                              .email.email
      )
  )
  // self sender
  or (
    length(recipients.to) == 1
    and sender.email.email == recipients.to[0].email.email
  )
)

// Not from legitimate Dropbox infrastructure
and sender.email.domain.root_domain not in~ (
  'dropbox.com',
  'docsend.com',
  'box.com',
  'wetransfer.com',
  // tuning: exlude hellosign emails that are covered in another rule
  'hellosign.com'
)

// Contains suspicious links to non-Dropbox/file-sharing domains
and any(body.links,
        (
          .href_url.domain.root_domain in~ $free_subdomain_hosts
          or .href_url.domain.root_domain in~ $free_file_hosts
        )
        and .href_url.domain.valid
)

// ML indicates potential credential theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)

type.inbound
// pdf image
and strings.contains(body.html.raw,
                     'https://ci3.googleusercontent.com/meips/ADKq_Naq6rm1GwC4XYZepCUQtEMnJ-r-HjyX_C5lBU7lpxQk1OIDV7vvQYvSJQWYmQCzG8moTgX3Wak625OtyHWRinVeUJs7K710JiIZ4JNXVpTmC8PJjV4K34GsBA=s0-d-e1-ft#https://res-1.cdn.office.net/assets/mail/file-icon/png/pdf_16x16.png'
)
// mentions attachments but there are none or just images with no pdfs
and strings.starts_with(body.current_thread.text, 'Please see attached.')
and all(attachments, .file_type in $file_types_images)
// self sender
and (
  length(recipients.to) == 1
  and sender.email.email == recipients.to[0].email.email
)
// display text ends with .pdf
and any(body.current_thread.links,
        strings.ends_with(.display_text, '.pdf')
        and .href_url.domain.subdomain is not null
        and .visible
        and not (
          .href_url.domain.root_domain == "googleusercontent.com"
          and strings.istarts_with(.href_url.path, "/mail-sig")
        )
)