Benefits enrollment impersonation

type.inbound
and sender.email.domain.domain not in $org_domains
and (
  length(body.current_thread.text) < 5000 or body.current_thread.text is null
)
and (
  regex.icontains(subject.subject,
                  '(open|benefits?) enrol{1,2}ment', // catches both enrolment and enrollment
                  'benefit(s)?.{0,10}(?:plan|choice|selection|deadline|period|summary)',
                  'hr benefits',
                  'annual enrol{1,2}ment',
                  'healthcare (choice|selection|opt.?in)',
                  '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                  'dependent (coverage|verification)',
                  '(health|dental|vision|insurance|medical) enrol{1,2}ment'
  )
  or regex.icontains(body.current_thread.text,
                     'benefit(s)? (plan|choice|selection|deadline|period)',
                     'hr benefits',
                     'annual enrol{1,2}ment',
                     'healthcare (choice|selection|opt.?in)',
                     '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                     'dependent (coverage|verification)',
                     '(health|dental|vision|insurance|medical) enrol{1,2}ment',
                     '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
                     'coverage.{0,20}(expire|terminate)',
                     'last (day|chance).{0,20}(enrol{1,2}|select)',
                     '(login|sign.?in).{0,20}(benefit portal|hr portal)',
                     '(verify|update|confirm).{0,20}(benefit.{0,20}selection)'
  )
  or any(attachments,
         regex.icontains(.file_name,
                         'fileDoc-Review',
                         '(open|benefits?) enrol{1,2}ment',
                         'annual enrol{1,2}ment',
                         '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
                         '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
         )
  )
)
and 2 of (
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name in ("urgency", "request")
  ),
  any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign"),
  (
    (length(body.current_thread.text) < 250 and length(attachments) == 1)
    or (body.current_thread.text is null and length(attachments) == 1)
  ),
  // lure in attachment
  (
    any(attachments,
        (
          .file_type in $file_types_images
          or .file_type in ("pdf", "docx", "doc")
          or .file_extension in $file_extensions_macros
        )
        and any(filter(file.explode(.), .scan.ocr.raw is not null),
                (
                  any(ml.nlu_classifier(.scan.ocr.raw).intents,
                      .name != "benign"
                  )
                  and any(ml.nlu_classifier(.scan.ocr.raw).entities,
                          .name in ("urgency", "request")
                  )
                )
        )
    )
  )
)
// negate replies
and (length(headers.references) == 0 or headers.in_reply_to is null)

// Negate common marketing mailers
and not regex.icontains(sender.display_name,
                        'HR (?:Events|Expert|Support Center|Studies|Knowledge Cloud|News Library|Crowd|Solutions|Interests)|HR and People Operations'
)
and not (
  // Constant Contact
  any(headers.hops,
      strings.icontains(.authentication_results.spf_details.designator,
                        "constantcontact.com"
      )
  )
  or any(headers.hops,
         strings.icontains(.received_spf.designator, "constantcontact.com")
  )
  or (
    (
      any(headers.hops,
          .index == 0
          and any(.authentication_results.dkim_details,
                  .domain == "auth.ccsend.com"
          )
      )
    )
    and headers.auth_summary.dmarc.pass
  )
  or any(headers.references, strings.iends_with(., "ccsend.com"))
  // Hubspot
  or any(headers.hops,
         strings.icontains(.authentication_results.spf_details.designator,
                           "hubspotemail.net"
         )
  )
)
and sender.email.domain.root_domain not in~ (
  'medicare.gov',
  'farmers.com',
  'uhc.com',
  'blueshieldca.com',
  'corestream.com'
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)