Credential phishing: 'Secure message' and engaging language

type.inbound
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
    )
    // add fallback when NLU doesn't pick up cred theft to check for suspicious links
    or any(body.current_thread.links,
           regex.icontains(.display_text, '(?:read|view|open) the message')
           and (
             .href_url.domain.root_domain not in $tranco_1m
             or .href_url.domain.domain in $free_file_hosts
             or .href_url.domain.root_domain in $free_file_hosts
             or .href_url.domain.root_domain in $free_subdomain_hosts
             or .href_url.domain.domain in $url_shorteners
             or .href_url.domain.domain in $social_landing_hosts
           )
    )
  )
  or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
         .name == "cred_theft" and .confidence in ("medium", "high")
  )
)

// ----- other suspicious signals here -----
and (
  (
    regex.icontains(body.current_thread.text,
                    "secured? (message|directory|document)"
    )
    or strings.icontains(body.current_thread.text, "document portal")
    or strings.icontains(body.current_thread.text, "encrypted message")
    or strings.icontains(body.current_thread.text, "protected message")
  )
  or any(body.previous_threads,
         regex.icontains(.text, "secured? (message|directory|document)")
         or strings.icontains(.text, "document portal")
         or strings.icontains(.text, "encrypted message")
         or strings.icontains(.text, "protected message")
  )
  or any(body.current_thread.links,
         regex.icontains(ml.link_analysis(.).final_dom.display_text,
                         'secured? (?:message|directory|document) access'
         )
         or regex.icontains(ml.link_analysis(.).final_dom.inner_text,
                            'secured? (?:message|directory|document) access'
         )
  )
  or (
    length(filter(ml.nlu_classifier(body.current_thread.text).entities,
                  .name == "urgency"
           )
    ) >= 2
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Secure Message" and .confidence != "low"
    )
  )
)
// todo: automated display name / human local part
// todo: suspicious link (unfurl click trackers)

// ----------

// has at least 1 link
and length(body.links) > 0

// negate legitimate message senders
and (
  sender.email.domain.root_domain not in ("protectedtrust.com")
  and any(body.links,
          .href_url.domain.root_domain != sender.email.domain.root_domain
  )
  // negate known secure mailers
  and not all(body.links,
              .href_url.domain.root_domain in (
                "mimecast.com",
                "cisco.com",
                "csiesafe.com"
              )
  )
  and any(headers.hops,
          .index == 0
          and not any(.fields,
                      strings.contains(.value,
                                       'multipart/mixed; boundary="PROOFPOINT_BOUNDARY_1"'
                      )
          )
  )
  and not (
    length(filter(attachments,
                  strings.ilike(.file_name,
                                "logo.*",
                                "lock.gif",
                                "SecureMessageAtt.html"
                  )
           )
    ) == 3
    and any(attachments,
            .file_type == "html"
            and any(file.explode(.),
                    .scan.html.title == "Proofpoint Encryption"
                    and any(.scan.url.urls,
                            strings.iends_with(.path,
                                               'formpostdir/safeformpost.aspx'
                            )
                    )
            )
            and strings.count(file.parse_html(.).raw, 'name="msg') > 3
    )
  )
  and not (
    any(headers.hops,
        any(.fields,
            .name in (
              'X-ZixNet',
              'X-VPM-MIV',
              'X-VPM-ActionCode',
              'X-VPM-SmtpTo'
            )
        )
    )
    and any(headers.domains,
            .root_domain in (
              "zixport.com",
              "zixcorp.com",
              "zixmail.net",
              "zixworks.com"
            )
    )
  )
  and not (
    any(headers.hops, any(.fields, .name == 'X-SendInc-Message-Id'))
    and any(headers.domains, .root_domain in ("sendinc.net"))
  )
  // negating Mimecast sends with MS banner and/or sender's email pulled out as a link
  and not length(filter(body.links,
                        (
                          .display_text is null
                          and .display_url.url == sender.email.domain.root_domain
                        )
                        or .href_url.domain.root_domain in (
                          "aka.ms",
                          "mimecast.com",
                          "cisco.com"
                        )
                 )
  ) == length(body.links)
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
  // or the sender is all undisclosed or there are no recipients
  or (
    length(recipients.to) == 0
    or all(recipients.to,
           strings.ilike(.display_name, "undisclosed?recipients")
    )
  )
  // or the sender exhibits a "self sender" pattern
  or (
    length(recipients.to) == 1
    and any(recipients.to, .email.email == sender.email.email)
  )
)
and not profile.by_sender().any_messages_benign

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)