Sublime MQL rules: link

type.inbound
and (
  any([body.current_thread.text, body.html.inner_text],
      strings.starts_with(., 'Cloud')
      or strings.icontains(., "Cloud+ ")
      or regex.icontains(., '^\x{FEFF}\s*Cloud')
  )
  // cloud emoji
  or regex.contains(body.current_thread.text, '^\x{2601}')
  or regex.icontains(body.current_thread.text, '^!\s*cloud storage')
  // address in the body
  or strings.icontains(body.current_thread.text,
                       '4563 Cloud Way, Server City, CA'
  )
  or any(html.xpath(body.html, '//img/@alt').nodes,
         regex.icontains(.raw, '^cloud (?:logo|storage)')
  )
  or regex.icontains(body.current_thread.text, 'cloud id:\s*#\d+')
  // body with cloud storage usage "percentage %"
  or (
    regex.icontains(body.current_thread.text,
                    '\bi?cloud\s(?:capacity|storage)\b'
    )
    and regex.icontains(body.current_thread.text, '\(?[0-9]{3}%\)?\s+?\b')
  )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence == 'high'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          'File Sharing and Cloud Services',
          'Payment Information',
          'Financial Communications'
        )
        and .confidence != 'low'
)
// sender domain matches no body domains
and length(filter(body.links,
                  .href_url.scheme != 'mailto'
                  and .href_url.domain.root_domain is not null
                  and .href_url.domain.root_domain != 'oracle.com'
           )
) > 0
and (
  all(filter(body.links,
             .href_url.scheme != 'mailto'
             and .href_url.domain.root_domain is not null
      ),
      .href_url.domain.root_domain != coalesce(sender.email.domain.root_domain,
                                               ""
      )
  )
  or network.whois(sender.email.domain).days_old <= 365
)
// negate legit cloud companies
and not (
  coalesce(sender.email.domain.root_domain, "") in (
    "cloud-cme.com",
    "cloudcounting.online",
    "cloudhealthtech.com",
    "cloudpano.com"
  )
  // check for SPF or DMARC passed
  and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate Spark Cloud Attachments
and not any(headers.hops,
            .index == 0
            and any(.fields,
                    .name == "X-Readdle-Spark-Cloud-Attachment"
                    and .value is not null
            )
)
and not (
  sender.email.email == "noreply@icloud.com.cn"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and sender.email.domain.root_domain != "coinbase.com"

// more than 0 less than 5 links
and 0 < length(body.links) < 5

// none of the links are to coinbase.com
and all(body.links, .href_url.domain.root_domain != "coinbase.com")

// low rep or url shortened links found
and any(body.links,
        .href_url.domain.domain in $url_shorteners
        or .href_url.domain.domain in $social_landing_hosts

        // exempting legitimate Google Maps shortener
        and (
          not strings.ilike(.href_url.url, "http?://goo.gl/maps*")
          or (
            .href_url.domain.domain not in $tranco_1m
            or .href_url.domain.domain in $free_file_hosts
            or .href_url.domain.root_domain in $free_file_hosts
            or .href_url.domain.root_domain in $free_subdomain_hosts
            or .href_url.domain.domain in $url_shorteners
            or .href_url.domain.domain in $social_landing_hosts
            or 

            // mass mailer link, masks the actual URL
            .href_url.domain.root_domain in (
              "hubspotlinks.com",
              "mandrillapp.com",
              "sendgrid.net",
            )
          )
        )
)
// Coinbase logo
and (
  any(attachments,
      .file_type in $file_types_images
      and any(ml.logo_detect(.).brands, .name == "Coinbase")
  )
  or any(ml.logo_detect(file.message_screenshot()).brands, .name == "Coinbase")
)

type.inbound
and (
  strings.ilike(sender.display_name, '*discord*')
  or (
    strings.ilevenshtein(sender.display_name, 'discord') <= 2
    and sender.display_name not in~ ("discogs")
  )
  or strings.ilike(sender.email.domain.domain, '*discord*')
  // Discord logo detection in image attachments
  or any(attachments,
         .file_type in $file_types_images
         and any(ml.logo_detect(.).brands,
                 .name == "Discord" and .confidence != "low"
         )
  )
  // Discord logo detection in message screenshot
  or any(ml.logo_detect(file.message_screenshot()).brands,
         .name == "Discord" and .confidence != "low"
  )
)
and (
  strings.icontains(subject.subject, 'you have received a new notification')
  or regex.icontains(subject.subject,
                     '(?:(?:new|unread|missed|pending|discord)\s+)?(?:message|notification|alert|activity|call) (?:from|waiting|pending)',
  )
  or strings.icontains(subject.subject, 'friend request')
  or strings.icontains(subject.subject, 'server invitation')
  or strings.icontains(subject.subject, 'mentioned you')
  or strings.icontains(subject.subject, 'direct message')
)
and not (
  sender.email.domain.root_domain in ("discord.com", "discogs.com")
  and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
// Subject or sender contains fax
and (
  any([subject.subject, sender.display_name],
      regex.icontains(.,
                      '\bfax\b',
                      '[ve][[:punct:]]?fax',
                      '[[:punct:]]fax\b',
                      '\bfax[[:punct:]]',
                      'fr[[:punct:]].{0,25}document',
                      'e.?f.?a.?x'
      )
  )
)
and (
  // body.current_thread.text logic
  (
    ( // strong notification terms in either the subject or body.current_thread.text
      any([subject.subject, body.current_thread.text],
          strings.icontains(., "New Fax Received")
          or strings.icontains(., "e-Fax Document")
          or strings.icontains(., "Fax Status")
          or strings.icontains(., "Fax ID")
          or strings.icontains(., "Fax Message Delivered")
          or strings.icontains(., "Incoming Fax")
          or strings.icontains(., "New Fax Document")
          or strings.istarts_with(., 'Fax message')
          or regex.icontains(.,
                             '(?:received|have) (a|(?:(.?\d.?))) (?:new )?e?fax'
          )
          or regex.icontains(., "to view (th(?:e|is) )?(?:fax|message)")
          or regex.icontains(.,
                             'transmit(?:ted|ting)?(?:\s+\w+){0,2}\s+(?:fax|facsimile)',
                             '(?:fax|facsimile)\s+(?:\s+\w+){0,2}transmit(?:ted|ting)?',
          )
      )
      and (
        // combined with above, we should have very high confidence this is a fax message
        (
          // date
          strings.icontains(body.current_thread.text, "Date:")
          or strings.icontains(body.current_thread.text, "Time Sent:")
          or strings.icontains(body.current_thread.text, "Time Received:")
          or strings.icontains(body.current_thread.text, "Received")
          // page count
          or regex.icontains(body.current_thread.text, "Num(ber)? of Pages?")
          or strings.icontains(body.current_thread.text, "Type: PDF")
        )
        // commonly abused brands
        or (
          strings.icontains(body.current_thread.text,
                            "eFax is a registered trademark of Consensus"
          )
          or strings.icontains(body.current_thread.text, "RingCentral, Inc")
        )
        // there is a link with the display text of some CTA
        or any(body.links,
               strings.icontains(.display_text, "open fax")
               // review document, view document review and sign document
               or regex.icontains(.display_text,
                                  "(?:re)?view (?:(?:&|and) sign )?(?:complete )?document"
               )
               or strings.icontains(.display_text, "Open document")
        )
      )
    )
    // attachment logic
    or (
      // the body.current_thread.text length is very short (probably just a warning banner)
      // and the attachment isn't used in the body of the message
      length(body.current_thread.text) < 300
      // and there are attachments
      and 0 < length(attachments) < 5
      // the attachments shouldn't be images which are used in the body of the html
      and any(attachments,
              strings.icontains(.file_name, 'fax')
              or (
                // or they are used in the body and OCR on them contains fax wording
                // the image is used in the HTML body
                .file_type in $file_types_images
                and (
                  any(regex.extract(.content_id, '^\<(.*)\>$'),
                      any(.groups,
                          strings.icontains(body.html.raw,
                                            strings.concat('src="cid:', ., '"')
                          )
                      )
                  )
                  or strings.icontains(body.html.raw, .content_id)
                )
                and (
                  // and that image contains fax wording
                  strings.icontains(beta.ocr(.).text, "New Fax Received")
                  or strings.icontains(beta.ocr(.).text, "New Fax Document")
                  or regex.icontains(beta.ocr(.).text,
                                     "(?:received|have) a (?:new )?fax"
                  )
                  or regex.icontains(beta.ocr(.).text,
                                     "to view (th(?:e|is) )?(?:fax|message)"
                  )
                  or regex.icontains(beta.ocr(.).text,
                                     'transmit(?:ted|ting)?(?:\s+\w+){0,2}\s+(?:fax|facsimile)',
                                     '(?:fax|facsimile)\s+(?:\s+\w+){0,2}transmit(?:ted|ting)?',
                  )
                )
              )
      )
    )
  )
)
// negate known fax mailers
and not (
  sender.email.domain.root_domain in (
    "faxage.com",
    'fax2mail.com',
    'ringcentral.com',
    'ringcentral.biz',
    'avaya.com',
    'egoldfax.com',
    'efax.com',
    'hellofax.com',
    'mfax.io',
    'goto.com',
    'faxmessage.net',
    'fuze.com',
    'retarus.net',
    'srfax.com',
    'myfax.com',
    '8x8.com',
    'zoom.us',
    'faxhd.com',
    'humblefax.com',
    'bridge.insure',
    'telecomsvc.com'
  )
  and headers.auth_summary.dmarc.pass
)

type.inbound
and length(body.links) > 0

// Google Logo in Attachment
and any(attachments,
        .file_type in $file_types_images
        and any(ml.logo_detect(.).brands, .name in ("Google"))
)
and any(attachments,
        .file_type in $file_types_images
        and (
          any(file.explode(.),
              // Fake activity warning
              3 of (
                strings.ilike(.scan.ocr.raw, "*new sign-in*"),
                strings.ilike(.scan.ocr.raw, "*google account*"),
                strings.ilike(.scan.ocr.raw, "*secure your account*"),
                strings.ilike(.scan.ocr.raw, "*check activity*"),
              )
          )
        )
)

// legitimate sign-in warnings contains links to google, gmail or googleapis.com
and (
  not all(body.links,
          .href_url.domain.root_domain in (
            "google.com",
            "gmail.com",
            "googleapis.com"
          )
          or .href_url.domain.root_domain is null
  )
)
and sender.email.domain.root_domain not in $org_domains
and sender.email.domain.root_domain != "google.com"

type.inbound
and 0 < length(body.links) < 50
// suspicious link
and any(body.links,
        (
          .href_url.domain.tld == "ru"
          or .href_url.domain.root_domain not in $tranco_1m
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $url_shorteners
          or .href_url.domain.domain in $social_landing_hosts
          // account for URL rewrites
          or (
            any(.href_url.query_params_decoded["domain"],
                strings.parse_domain(.).tld == "ru"
                or strings.parse_domain(.).root_domain not in~ $tranco_1m
                or strings.parse_domain(.).domain in~ $free_file_hosts
                or strings.parse_domain(.).root_domain in~ $free_file_hosts
                or strings.parse_domain(.).root_domain in~ $free_subdomain_hosts
                or strings.parse_domain(.).domain in~ $url_shorteners
                or strings.parse_domain(.).domain in~ $social_landing_hosts
            )
          )
          or 

          // mass mailer link, masks the actual URL
          .href_url.domain.root_domain in (
            "hubspotlinks.com",
            "mandrillapp.com",
            "sendgrid.net",
            "rs6.net"
          )

          // Google AMP redirect
          or (
            .href_url.domain.sld == "google"
            and strings.starts_with(.href_url.path, "/amp/")
          )

          // Recipient email address in link
          or any(body.links,
                 any(recipients.to,
                     strings.icontains(..href_url.url, .email.email)
                     and any(recipients.to, .email.domain.valid)
                 )
          )
          or .href_url.domain.root_domain == "beehiiv.com"
        )

        // exclude sources of potential FPs
        and (
          .href_url.domain.root_domain not in (
            "svc.ms",
            "sharepoint.com",
            "1drv.ms",
            "microsoft.com",
            "aka.ms",
            "msftauthimages.net",
            "office.com",
            "microsoftproject.com"
          )
          or any(body.links, .href_url.domain.domain in $free_file_hosts)
        )
        and .href_url.domain.root_domain not in $org_domains
        and .href_url.domain.valid
)

// not a reply
and (length(headers.references) == 0 or headers.in_reply_to is null)

// Microsoft logo
and (
  any(attachments,
      .file_type in $file_types_images
      and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Microsoft"))
  )
  or strings.istarts_with(strings.replace_confusables(body.current_thread.text),
                          "Microsoft "
  )
  or (
    regex.imatch(strings.replace_confusables(body.current_thread.text),
                 '[\n\s]*[o0O]ff[il1]ce\b.*'
    )
    and not regex.icontains(strings.replace_confusables(body.current_thread.text
                            ),
                            'office (for lease|rent|sale)'
    )
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         strings.starts_with(.name, "Microsoft")
  )
  or (
    regex.icontains(body.html.raw,
                    '<table[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}\s*</tr>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}'
    )
    or regex.icontains(body.html.raw,
                       '<td style="background:\s*rgb\(246,\s*93,\s*53\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(129,\s*187,\s*5\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(4,\s*165,\s*240\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(255,\s*186,\s*7\);\s*height:\d+px;">'
    )
    or 4 of (
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(245, 189, 67\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(137, 184, 57\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(217, 83, 51\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(71, 160, 218\);">.{0,10}</td>'
      )
    )
  )
  or regex.icontains(body.html.raw,
                     '<table[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}\s*</tr>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}'
  )
  or 3 of (
    regex.icontains(body.html.raw, '.password-expiration'),
    regex.icontains(body.html.raw, 'color: #2672ec;'),
    regex.icontains(body.html.raw, 'M\x{00AD}ic\x{00AD}ro\x{00AD}so\x{00AD}ft')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(246,\s?93,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?187,\s?5\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?7\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)red'
    ),
    regex.icontains(body.html.raw, 'rgb\(19,\s?186,\s?132\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?166,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?8\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(245,\s?189,\s?67\)'),
    regex.icontains(body.html.raw, 'rgb\(137,\s?184,\s?57\)'),
    regex.icontains(body.html.raw, 'rgb\(217,\s?83,\s?51\)'),
    regex.icontains(body.html.raw, 'rgb\(71,\s?160,\s?218\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(73,\s?161,\s?232\)'),
    regex.icontains(body.html.raw, 'rgb\(224,\s?92,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(139,\s?183,\s?55\)'),
    regex.icontains(body.html.raw, 'rgb\(244,\s?188,\s?65\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(213,\s?56,\s?62\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?114,\s?30\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?110,\s?173\)'),
    regex.icontains(body.html.raw, 'rgb\(227,\s?209,\s?43\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(246,\s?93,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?187,\s?5\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?7\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(242,\s?80,\s?34\)'),
    regex.icontains(body.html.raw, 'rgb\(127,\s?186,\s?0\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?164,\s?239\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?185,\s?0\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(243,\s?83,\s?37\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?188,\s?6\)'),
    regex.icontains(body.html.raw, 'rgb\(5,\s?166,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?8\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(243,\s?80,\s?34\)'),
    regex.icontains(body.html.raw, 'rgb\(128,\s?187,\s?3\)'),
    regex.icontains(body.html.raw, 'rgb\(3,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?185,\s?3\)')
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?(#)?(FF1940|eb5024|F25022|FF1941|red)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?(#)?(36ba57|3eb55d|7db606|7FBA00|36ba58|green)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(04a1d6|04B5F0|05a1e8|00A4EF|01a4ef|04a5f0)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(FFCA07|f7b408|FFB900|FFCA08|ffb901|ffba07)'
    ),
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(f65314|f65d35|49a1e8|E74F23|F35325)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(7cbf42|81bb05|e05c35|7AB206|81BC06)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(00a4ef|0078d7|8bb737|04a5f0|059EE4|05A6F0)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(ffb900|ffba07|f4bc41|F2B108|FFBA08)'
    ),
  )
  // fuzzy approach
  or 4 of (
    regex.icontains(body.html.raw,
                    'rgb\((2[1-4][0-9]|250),\s?(7[0-9]|8[0-9]|9[0-3]),\s?(3[0-9]|4[0-9]|5[0-3])\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\((12[0-9]|13[0-9]),\s?(18[0-9]|190),\s?([0-9]|10)\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\(([0-9]|1[0-5]),\s?(16[0-5]|166),\s?(23[0-9]|240)\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\((25[0-5]),\s?(18[5-9]|19[0-9]),\s?([0-9]|10)\)'
    )
  )
)

// suspicious content
and (
  // current thread is empty, but an image attachment is branded as microsoft.
  // common in image as content
  (
    body.current_thread.text == ""
    and any(attachments,
            .file_type in $file_types_images
            and any(ml.logo_detect(.).brands,
                    strings.starts_with(.name, "Microsoft")
            )
    )
  )
  or (
    strings.ilike(body.plain.raw,
                  "*password*",
                  "*document*",
                  "*voicemail*",
                  "*cache*",
                  "*fax*",
                  "*storage*",
                  "*quota*",
                  "*message*"
    )
    and strings.ilike(body.plain.raw,
                      "*terminated*",
                      "*review*",
                      "*expire*",
                      "*click*",
                      "*view*",
                      "*exceed*",
                      "*clear*",
                      "*only works*",
                      "*failed*",
                      "*deleted*",
                      "*revalidated*",
                      "*renewal*"
    )
  )
  or (
    any(attachments,
        .file_type in $file_types_images
        and any(file.explode(.),
                strings.ilike(.scan.ocr.raw,
                              "*password*",
                              "*document*",
                              "*voicemail*",
                              "*cache*",
                              "*fax*",
                              "*storage*",
                              "*quota*",
                              "*messages*"
                )
                and strings.ilike(.scan.ocr.raw,
                                  "*terminated*",
                                  "*review*",
                                  "*expire*",
                                  "*click*",
                                  "*view*",
                                  "*exceed*",
                                  "*clear*",
                                  "*only works*",
                                  "*failed*",
                                  "*deleted*"
                )
        )
    )
  )
  or (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    strings.ilike(beta.ocr(file.message_screenshot()).text,
                  "*password*",
                  "*document*",
                  "*voicemail*",
                  "*cache*",
                  "*fax*",
                  "*storage*",
                  "*quota*",
                  "*messages*"
    )
    and strings.ilike(beta.ocr(file.message_screenshot()).text,
                      "*terminated*",
                      "*review*",
                      "*expire*",
                      "*click*",
                      "*view*",
                      "*exceed*",
                      "*clear*",
                      "*only works*",
                      "*failed*",
                      "*deleted*",
                      "*revalidated*",
                      "*renewal*"
    )
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence in~ ("medium", "high")
    )
    or any(attachments,
           .file_type in $file_types_images
           and any(file.explode(.),
                   any(ml.nlu_classifier(.scan.ocr.raw).intents,
                       .name == "cred_theft"
                       and .confidence in ("medium", "high")
                   )
           )
    )
  )
)
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftproject.com",
  "microsoftstoreemail.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "office365.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com",
)

// negate legitimate Office 365 bouncebacks
and not (
  length(attachments) > 0
  and all(attachments,
          .content_type in ("message/delivery-status", "message/rfc822")
  )
  and (sender.email.local_part in ('postmaster', 'mailer-daemon'))
)

// negate Microsoft "welcome to the X group" notifications
and not (
  headers.auth_summary.dmarc.pass
  and length(attachments) == 6
  and length(filter(attachments,
                    strings.istarts_with(.file_name, "GuestWelcomeEmail")
             )
  ) == 5
  and length(filter(body.links,
                    (
                      .href_url.domain.domain not in (
                        "outlook.office365.com",
                        "aka.ms",
                        "go.microsoft.com"
                      )
                    )
                    and not .href_url.domain.domain == sender.email.domain.domain
             )
  ) == 0
  and subject.subject == strings.replace_confusables(subject.subject)
)

// negate legitimate microsoft b2b applications invitations
and not (
  sender.email.local_part == "invites"
  and sender.email.domain.root_domain == "onmicrosoft.com"
  // infra validated message id
  and strings.icontains(headers.message_id, "pepf")
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and (
      not headers.auth_summary.dmarc.pass
      // MS quarantine digest emails from an org domain are router "internally" to MS, therefore, there is no authentication information
      or not (
        headers.auth_summary.dmarc.pass is null
        and all(headers.domains,
                .root_domain in ("outlook.com", "office365.com")
        )
        // typical emails from freemail Outlook accounts are from prod.outlook.com
        and strings.ends_with(headers.message_id, "protection.outlook.com>")
      )
    )
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

// exclude marketing jargon from ms partners
and not regex.icontains(body.current_thread.text,
                        '(schedul(e|ing)|set up).{0,20}(call|meeting|demo|zoom|conversation|time|tool|discussion)|book.{0,10}(meeting|demo|call|slot|time)|connect.{0,12}(with me|phone|email)|my.{0,10}(calendar|cal)|reserve.{0,10}s[pl]ot|break the ice|want to know more?|miss your chance|if you no longer wish|if you no longer want|if you wish to opt out|low-code (development|approach|solution|journey|platform)|(?:invite|virtual).{0,30}(webinar|presentation)'
)

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "catbox.moe"
        and not strings.iends_with(.href_url.path, ".json")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)