Sublime MQL rules: dlp

type.outbound
and (
  // Body: Amex 15-digit with standard 4-6-5 grouping (spaces or dashes)
  regex.contains(body.current_thread.text,
    '\b3[47]\d{2}[\s-]?\d{6}[\s-]?\d{5}\b'
  )

  // Attachments: scan extracted strings from PDFs, Office docs, CSVs, etc.
  or any(attachments,
    .file_extension in~ ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'txt', 'csv', 'eml', 'msg')
    and any(file.explode(.),
      any(.scan.strings.strings,
        regex.contains(., '\b3[47]\d{2}[\s-]?\d{6}[\s-]?\d{5}\b')
      )
    )
  )
)

type.outbound
and (
  // Body: Discover 6011 prefix
  regex.contains(body.current_thread.text,
    '\b6011[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Body: Discover 65xx prefix
  or regex.contains(body.current_thread.text,
    '\b65\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Body: Discover 644–649 prefix
  or regex.contains(body.current_thread.text,
    '\b64[4-9]\d[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Body: Discover/UnionPay co-branded 622126–622925
  or regex.contains(body.current_thread.text,
    '\b622(?:1(?:2[6-9]|[3-9]\d)|[2-8]\d{2}|9(?:[01]\d|2[0-5]))\d{2}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Attachments: scan extracted strings from PDFs, Office docs, CSVs, etc.
  or any(attachments,
    .file_extension in~ ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'txt', 'csv', 'eml', 'msg')
    and any(file.explode(.),
      any(.scan.strings.strings,
        regex.contains(., '\b6011[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        or regex.contains(., '\b65\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        or regex.contains(., '\b64[4-9]\d[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        or regex.contains(.,
          '\b622(?:1(?:2[6-9]|[3-9]\d)|[2-8]\d{2}|9(?:[01]\d|2[0-5]))\d{2}[\s-]?\d{4}[\s-]?\d{4}\b'
        )
      )
    )
  )
)

type.outbound
and (
  // Body: Mastercard 5-series (51–55 prefix, 16 digits)
  regex.contains(body.current_thread.text,
    '\b5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Body: Mastercard 2-series BINs (2221–2720, 16 digits)
  // Range breakdown: 2221-2229, 2230-2299, 2300-2699, 2700-2719, 2720
  or regex.contains(body.current_thread.text,
    '\b(?:222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Attachments: scan extracted strings from PDFs, Office docs, CSVs, etc.
  or any(attachments,
    .file_extension in~ ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'txt', 'csv', 'eml', 'msg')
    and any(file.explode(.),
      any(.scan.strings.strings,
        regex.contains(., '\b5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        or regex.contains(.,
          '\b(?:222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
        )
      )
    )
  )
)

type.outbound
and (
  // ── Body scanning ─────────────────────────────────────────────────────────

  // Visa 16-digit
  regex.contains(body.current_thread.text, '\b4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')

  // Visa 13-digit (legacy)
  or regex.contains(body.current_thread.text, '\b4\d{3}[\s-]?\d{4}[\s-]?\d{5}\b')

  // Mastercard 5-series (51–55)
  or regex.contains(body.current_thread.text, '\b5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')

  // Mastercard 2-series BINs (2221–2720)
  or regex.contains(body.current_thread.text,
    '\b(?:222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Amex 15-digit (34 or 37 prefix, 4-6-5 grouping)
  or regex.contains(body.current_thread.text, '\b3[47]\d{2}[\s-]?\d{6}[\s-]?\d{5}\b')

  // Discover 6011
  or regex.contains(body.current_thread.text, '\b6011[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')

  // Discover 65xx
  or regex.contains(body.current_thread.text, '\b65\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')

  // Discover 644–649
  or regex.contains(body.current_thread.text, '\b64[4-9]\d[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')

  // Discover/UnionPay co-branded 622126–622925
  or regex.contains(body.current_thread.text,
    '\b622(?:1(?:2[6-9]|[3-9]\d)|[2-8]\d{2}|9(?:[01]\d|2[0-5]))\d{2}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // ── Attachment scanning ────────────────────────────────────────────────────

  or any(attachments,
    .file_extension in~ ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'txt', 'csv', 'eml', 'msg')
    and any(file.explode(.),
      any(.scan.strings.strings,
        // Visa 16-digit
        regex.contains(., '\b4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        // Visa 13-digit
        or regex.contains(., '\b4\d{3}[\s-]?\d{4}[\s-]?\d{5}\b')
        // Mastercard 5-series
        or regex.contains(., '\b5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        // Mastercard 2-series
        or regex.contains(.,
          '\b(?:222[1-9]|22[3-9]\d|2[3-6]\d{2}|27[01]\d|2720)[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
        )
        // Amex
        or regex.contains(., '\b3[47]\d{2}[\s-]?\d{6}[\s-]?\d{5}\b')
        // Discover 6011
        or regex.contains(., '\b6011[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        // Discover 65xx
        or regex.contains(., '\b65\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        // Discover 644-649
        or regex.contains(., '\b64[4-9]\d[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        // Discover/UnionPay 622126-622925
        or regex.contains(.,
          '\b622(?:1(?:2[6-9]|[3-9]\d)|[2-8]\d{2}|9(?:[01]\d|2[0-5]))\d{2}[\s-]?\d{4}[\s-]?\d{4}\b'
        )
      )
    )
  )
)

type.outbound
and (
  // Body: Visa 16-digit (4XXX XXXX XXXX XXXX or 4XXX-XXXX-XXXX-XXXX)
  regex.contains(body.current_thread.text,
    '\b4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b'
  )

  // Body: Visa 13-digit legacy (4XXX XXXX XXXXX)
  or regex.contains(body.current_thread.text,
    '\b4\d{3}[\s-]?\d{4}[\s-]?\d{5}\b'
  )

  // Attachments: scan extracted strings from PDFs, Office docs, CSVs, etc.
  or any(attachments,
    .file_extension in~ ('pdf', 'doc', 'docx', 'xls', 'xlsx', 'txt', 'csv', 'eml', 'msg')
    and any(file.explode(.),
      any(.scan.strings.strings,
        regex.contains(., '\b4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b')
        or regex.contains(., '\b4\d{3}[\s-]?\d{4}[\s-]?\d{5}\b')
      )
    )
  )
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // DNI: 7-8 digits
        regex.contains(., '\b\d{7,8}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'DNI|documento\s+nacional|identity\s+card')
)
and (
  strings.icontains(sender.email.domain.tld, "ar")
  or strings.icontains(body.current_thread.text, "argentina")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // BSB: 6 digits (XXX-XXX format)
        // Account: 6-10 digits
        regex.contains(., '\b\d{3}-\d{3}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'BSB|bank\s+account|account\s+number')
)

type.outbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_extension in~ ('.csv', '.txt', '.xlsx', '.xls')
        )
        and any(file.explode(.),
                // Credit card: 13-19 digits with optional spaces/hyphens
                regex.contains(.scan.ocr.raw, '\b(?:\d{4}[\s\-]?){3}\d{1,7}\b')
        )
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Driver's license varies by state, generally 6-10 alphanumeric
        regex.contains(., '\b[A-Z0-9]{6,10}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'driver.?s?\s+licen[cs]e|DL\s+number')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Medicare: 10 digits (XXXX XXXXX X format)
        regex.contains(., '\b\d{4}\s?\d{5}\s?\d\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'medicare|medical\s+account')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Australian passport: 1 letter + 7 digits
        regex.contains(., '\b[A-Z]\d{7}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'passport|travel\s+document')
)
and (
  strings.icontains(sender.email.domain.tld, "au")
  or strings.icontains(body.current_thread.text, "australia")
)

type.outbound
and any(ml.logo_detect(beta.message_screenshot()).brands, strings.ilike(.name, "*bank*", "*financial*"))
and any([body.current_thread.text, subject.subject],
        // SWIFT code: 4 letters (bank) + 2 letters (AU) + 2 chars (location) + optional 3 chars (branch)
        regex.contains(., '\b[A-Z]{4}AU[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // TFN: 8 or 9 digits, sometimes with spaces or hyphens
        regex.contains(., '\b\d{3}[\s\-]?\d{3}[\s\-]?\d{3}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'tax\s+file\s+number|TFN')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Austrian ID card: 7-8 digits
        regex.contains(., '\b\d{7,8}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'personalausweis|identity\s+card|Ausweis')
)
and (
  strings.icontains(sender.email.domain.tld, "at")
  or strings.icontains(body.current_thread.text, "austria")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Austrian SSN: 10 digits (XXXX XXXXXX format)
        regex.contains(., '\b\d{4}[\s]?\d{6}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'sozialversicherung|social\s+security|SVNR')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Austrian Tax ID: 9 digits
        regex.contains(., '\b\d{2}[\s\-]?\d{3}[\s\-]?\d{4}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'steuernummer|tax\s+ID|FinanzOnline')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // AWS Access Key ID: AKIA followed by 16 alphanumeric characters
        regex.contains(., '\bAKIA[0-9A-Z]{16}\b')
)
and (
  any([body.current_thread.text, subject.subject],
          regex.icontains(., 'aws|amazon|access\s+key|secret\s+key')
  )
  or any([body.current_thread.text, subject.subject],
          // AWS Secret Access Key: 40-character base64 string
          regex.contains(., '\b[A-Za-z0-9/+=]{40}\b')
  )
)

type.outbound
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'azure|microsoft\s+cloud')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'auth|token|credential|secret|key')
)
and any([body.current_thread.text, subject.subject],
        // Long alphanumeric tokens
        regex.contains(., '\b[A-Za-z0-9_-]{40,}\b')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Basic auth format: "Basic " followed by base64
        regex.contains(., '\bBasic\s+[A-Za-z0-9+/]+=*\b')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Belgian National Number: YY.MM.DD-XXX.XX format (11 digits)
        regex.contains(., '\b\d{2}\.?\d{2}\.?\d{2}[\s\-]?\d{3}\.?\d{2}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'rijksregister|national\s+number|numéro\s+national')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // CPF: 11 digits in XXX.XXX.XXX-XX format
        regex.contains(., '\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'CPF|cadastro\s+de\s+pessoas|tax\s+ID')
)
and (
  strings.icontains(sender.email.domain.tld, "br")
  or strings.icontains(body.current_thread.text, "brazil")
  or strings.icontains(body.current_thread.text, "brasil")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // RG: 7-9 digits
        regex.contains(., '\b\d{1,2}\.?\d{3}\.?\d{3}-?[0-9X]\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'RG|registro\s+geral|identity\s+card')
)
and (
  strings.icontains(sender.email.domain.tld, "br")
  or strings.icontains(body.current_thread.text, "brazil")
  or strings.icontains(body.current_thread.text, "brasil")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Bulgarian UCN: 10 digits
        regex.contains(., '\b\d{10}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'ЕГН|uniform\s+civil|personal\s+number')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Institution number: 3 digits, Transit: 5 digits, Account: 7-12 digits
        regex.contains(., '\b\d{3}[\s\-]?\d{5}[\s\-]?\d{7,12}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'bank\s+account|transit|institution\s+number')
)

type.outbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_extension in~ ('.csv', '.txt', '.xlsx', '.xls')
        )
        and any(file.explode(.),
                regex.contains(.scan.ocr.raw, '\b(?:\d{4}[\s\-]?){3}\d{1,7}\b')
        )
)
and (
  strings.icontains(sender.email.domain.tld, "ca")
  or strings.icontains(body.current_thread.text, "canada")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Driver's license varies by province, typically 15-16 alphanumeric characters
        regex.contains(., '\b[A-Z0-9]{15,16}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'driver.?s?\s+licen[cs]e|DL\s+number|permis\s+de\s+conduire')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Health card numbers vary by province, generally 10-12 digits
        regex.contains(., '\b\d{10,12}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'health\s+card|health\s+service|OHIP|RAMQ|MSP|AHCIP')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Canadian passport: 2 letters + 6 digits
        regex.contains(., '\b[A-Z]{2}\d{6}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'passport|travel\s+document')
)
and (
  strings.icontains(sender.email.domain.tld, "ca")
  or strings.icontains(body.current_thread.text, "canada")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // PHIN varies by province but generally alphanumeric
        regex.contains(., '\b[A-Z0-9]{9,12}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'PHIN|personal\s+health\s+identification|health\s+ID')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // SIN: 9 digits in XXX-XXX-XXX format
        regex.contains(., '\b\d{3}[\s\-]?\d{3}[\s\-]?\d{3}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'social\s+insurance|SIN|NAS')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Chilean RUT: 7-8 digits with verification digit
        regex.contains(., '\b\d{1,2}\.\d{3}\.\d{3}-[0-9Kk]\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'RUT|cédula|identity\s+card|CDI')
)
and (
  strings.icontains(sender.email.domain.tld, "cl")
  or strings.icontains(body.current_thread.text, "chile")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Chinese ID: 18 digits or 15 digits
        regex.contains(., '\b\d{17}[0-9Xx]\b')
        or regex.contains(., '\b\d{15}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'resident\s+ID|身份证|chinese\s+ID|china')
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // CDC: 8-10 digits
        regex.contains(., '\b\d{8,10}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'cédula|citizenship\s+card|CDC|ciudadanía')
)
and (
  strings.icontains(sender.email.domain.tld, "co")
  or strings.icontains(body.current_thread.text, "colombia")
)

type.outbound
and any([body.current_thread.text, subject.subject],
        // Croatian OIB: 11 digits
        regex.contains(., '\b\d{11}\b')
)
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'OIB|osobni\s+identifikacijski|personal\s+identification')
)