Link: Suspicious Sharepoint folder share

type.inbound
and any(filter(body.links,
               // folder share
               strings.icontains(.href_url.domain.domain, "-my.sharepoint.com")
               and strings.icontains(.href_url.url, "/:f:/g/personal")
               
               // remove links which contains the domain sld in the subdomain (tenenat) name
               and not any($org_slds,
                           strings.icontains(..href_url.domain.subdomain, .)
               )
        ),
        ( // a shared URL file
          regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                          '<div role="row" aria-label="[^\"]+.url, url File, Shared'
          )
          or 
          // the name of the file is all caps allowing for special charaters too
          regex.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                         '<button data-automationid=\"FieldRenderer-name\" data-selection-invoke=\"true\" title="[A-Z0-9_\-\s]+\.[^\"]{3,4}\" role=\"link\" type=\"button\"'
          )
          or 
          // includes odd wording
          regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                          '<button data-automationid=\"FieldRenderer-name\" data-selection-invoke=\"true\" title="[^\"]*(?:dropbox|docusign|secured?|important|shared?|protected|encrypted|scanne[rd]|_IMG_|IMG[_-](?:\d|\W)|doc(?:ument)?\s?\d+|one_drive|OneDrive|Access|Review Document|Click Here|Download|validate|Confidential(?:ity)?|payment|invoice|INV(?:_|\s)?\d+|INV(?:_|\s)|P[O0]\W+?\d+|Past Due|Remit(?:tance)?|statement|Purchase Order|settlement|contract agreement|Pr[0o]p[0o]sal|contract doc|EFax|\.\.\.)[^\"]*\.[^\"]{3,4}\" role=\"link\" type=\"button\"'
          )
        )
        // and only a single file shared
        and strings.icount(ml.link_analysis(., mode="aggressive").final_dom.raw,
                           '<div role="presentation" data-automationid="ListCell" class="ms-List-cell"'
        ) == 1
)
// message is not from sharepoint actual
and not (
  strings.starts_with(headers.message_id, '<Share-')
  and strings.ends_with(headers.message_id, '@odspnotify>')
)
and (
  // not solicited
  not profile.by_sender().solicited
  // new or outlier sender prevalence
  or profile.by_sender().prevalence in ("new", "outlier")
  // marked as spam and no FPs
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)