Sublime MQL rules: service

type.inbound
and sender.email.email == "appleid@id.apple.com"
and (
  // the actor controls the name portion of the apple account, so extract that
  // english starts with Dear, but other language might start with Hello,
  // the email template and html div class names are the same between languages
  any(html.xpath(body.html, '//div[@class="email-body"]').nodes,
      any(regex.iextract(.display_text, '^(?P<first_line>[^\n]+)\n'),
          // NLU catches the actor controlled values as callback
          any(ml.nlu_classifier(beta.ml_translate(.named_groups["first_line"]).text
              ).intents,
              .name == "callback_scam"
          )
          // we have to account for NLU not catching it as callback_scam
          // this catches more than one digit followed by all capital letters
          // 599 USD, we use the unicode category Lu for capital letters from a bunch of languges
          or (
            any(regex.extract(beta.ml_translate(.named_groups["first_line"]).text,
                              '(\d{2,} \p{Lu}{2,5} )'
                ),
                not regex.icontains(.full_match, '[AP]M\s+$')
            )
          )
          // commonly observed phrase "if not you call"
          or strings.icontains(.named_groups["first_line"], "If not you call")
          // first line ends in a phone number
          or regex.contains(.named_groups["first_line"], '\d+,$')
      )
  )
  // the email address of the apple account appears in the body of the message
  or (
    any(body.current_thread.links,
        .parser == "plain"
        and .href_url.scheme == "mailto"
        // actor observed using `appleservice207@icloud.com`
        and (
          (
            strings.istarts_with(strings.parse_email(.href_url.url).local_part,
                                 'apple'
            )
            and strings.parse_email(.href_url.url).domain.domain not in $org_domains
          )
          // newly registered domains like peekaboo.baby
          or network.whois(.href_url.domain).days_old < 30
        )
    )
  )
)
and not recipients.to[0].email.domain.domain in $org_domains

type.inbound
and length(filter(body.links, .href_url.domain.root_domain == "breely.com")) == 1
and any(body.links,
        .href_url.domain.root_domain == "breely.com"
        and strings.icontains(.display_text, ".pdf")
)

type.inbound
and sender.email.email == "message@adobe.com"
and headers.auth_summary.spf.pass
and headers.auth_summary.dmarc.pass
and any(html.xpath(body.html,
                   "//td[@style[contains(., 'adobe-clean-display')]]/strong/a/text()"
        ).nodes,
        strings.parse_email(.raw).domain.root_domain not in $org_domains
        and strings.parse_email(.raw).email not in $recipient_emails
        and strings.parse_email(.raw).email not in $sender_emails
        and not (
          strings.parse_email(.raw).domain.domain not in $free_email_providers
          and strings.parse_email(.raw).domain.domain in $recipient_domains
          and strings.parse_email(.raw).domain.domain in $sender_domains
        )
)

type.inbound
and recipients.to[0].email.domain.domain == "email.adobe.com"
and regex.icontains(body.current_thread.text,
                    "(?:approved?|view) (?:document|payment)"
)

type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// sender has a recently created email domain
and any(filter(body.links, .href_url.scheme == 'mailto'),
        network.whois(.href_url.domain).days_old < 365
)

type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// the email address in the body
and any(filter(body.links,
               .href_url.scheme == 'mailto'
               // is not the recipient
               and .href_url.url !~ recipients.to[0].email.email
               // not in org domains
               and .href_url.domain.domain not in $org_domains
               // and not adobe
               and .href_url.domain.root_domain != "adobe.com"
        ),
        // and has not been observed inbound/outbound in the environment
        .href_url.domain.domain not in $sender_domains
        and .href_url.domain.domain not in $recipient_domains
)
// there is a single link to an adobe hosted content
and length(distinct(filter(body.links,
                           .href_url.domain.root_domain == "adobe.com"
                           and strings.istarts_with(.href_url.path, '/id/urn:')
                    ),
                    .href_url.url
           )
) == 1

type.inbound
// appears to be from apple (don't care it being legit from apple, appearing is fine)
and sender.email.domain.domain == "email.apple.com"
// has a link
and any(body.current_thread.links,
        .href_url.domain.domain in ('testflight.apple.com')
)
and (
  // get the app description
  any(html.xpath(body.html,
                 '//h2[contains(text(), "App Description")]/ancestor::tr/following-sibling::tr//pre'
      ).nodes,
      any(ml.nlu_classifier(.display_text).entities,
          .name == "org"
          and any(["openai", "openal", "open ai", "open al", "chatgpt", "meta"],
                  strings.icontains(..text, .)
          )
      )
  )

  // parse out the template to get the app and org name
  or any(html.xpath(body.html, '//h2[@aria-label]').nodes,
         any(regex.iextract(.display_text,
                            '(?P<app_name>[^\r\n]+)[\r\n]+By (?P<dev_name>.*) for IOS.$'
             ),
             any(["openai", "openal", "open ai", "open al", "chatgpt", "meta"],
                 strings.icontains(..named_groups["dev_name"], .)
                 or strings.icontains(..named_groups["app_name"], .)
             )
         )
  )
)

type.inbound
and sender.email.email == "no-reply@sns.amazonaws.com"
and not coalesce(strings.icontains(headers.return_path.local_part,
                                   'aws-ses-bounces'
                 ),
                 false
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "callback_scam" and .confidence != "low"
  )
  or (
    regex.icontains(body.current_thread.text,
                    (
                      "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                    )
    )
    and (
      3 of (
        strings.ilike(body.current_thread.text, '*purchase*'),
        strings.ilike(body.current_thread.text, '*payment*'),
        strings.ilike(body.current_thread.text, '*transaction*'),
        strings.ilike(body.current_thread.text, '*subscription*'),
        strings.ilike(body.current_thread.text, '*antivirus*'),
        strings.ilike(body.current_thread.text, '*order*'),
        strings.ilike(body.current_thread.text, '*support*'),
        strings.ilike(body.current_thread.text, '*receipt*'),
        strings.ilike(body.current_thread.text, '*invoice*'),
        strings.ilike(body.current_thread.text, '*call*'),
        strings.ilike(body.current_thread.text, '*cancel*'),
        strings.ilike(body.current_thread.text, '*renew*'),
        strings.ilike(body.current_thread.text, '*refund*'),
        strings.ilike(body.current_thread.text, '*host key*')
      )
    )
    // phone number regex
    and any([body.current_thread.text, subject.subject],
            regex.icontains(.,
                            '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                            '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
            )
    )
  )
)

type.inbound
and sender.email.email in (
  "no-reply@calendly.com",
  "notifications@calendly.com"
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
)

type.inbound
and sender.email.domain.domain == 'res.cisco.com'
and any(headers.reply_to, .email.domain.domain != 'res.cisco.com')
and (
  length(recipients.to) == 0
  or all(recipients.to, .display_name == "Undisclosed recipients")
)
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in ("Financial Communications", "Request to View Invoice")
  )
  or any(ml.nlu_classifier(subject.base).entities, .name == "financial")
)

type.inbound
and any(attachments,
        .file_type in ("doc", "docx")
        and any(file.explode(.),
                strings.icontains(.scan.strings.raw, "sharefile.com")
                and strings.icontains(.scan.strings.raw,
                                      "src=system-email-outlookplugin-new"
                )
        )
)  

type.inbound
and regex.count(body.html.raw,
                '(?:<(?:p|div)[^>]*>\s*<br>\s*</(?:p|div)>\s*){6,}'
) >= 1
and sender.email.domain.root_domain != "cognitoforms.com"
and any(body.current_thread.links,
        .href_url.domain.root_domain == "cognitoforms.com"
        and length(.display_text) > 8
        // negating benign hits
        and not .display_text =~ "opt-out"
        and not strings.icontains(.display_text, "cognitoforms.com")
)
// negating messages which use cognito and other mailing platforms
and not any(body.current_thread.links, .display_text =~ "unsubscribe")

type.inbound
// message is sent from coursera (auth doesn't really matter here)
and sender.email.domain.root_domain == "coursera.org"
and (
  // the email being changed appears in the body as a link
  any(body.links,
      .href_url.scheme == "mailto"
      and .href_url.domain.root_domain != "coursera.org"
      // the domain is newly registered
      and network.whois(.href_url.domain).days_old < 365
  )
  // in other cases the email address isn't in the email body and it's only as a rcpt
  or network.whois(recipients.to[0].email.domain).days_old < 365
  // extract the first line and do NLU on it
  or any(ml.nlu_classifier(regex.extract(body.current_thread.text,
                                         '^(?P<first_line>[^\n]+)\n'
                           )[0].named_groups["first_line"]
         ).intents,
         .name == "callback_scam" and .confidence == "high"
  )
)
// not in org_domains
and all(recipients.to, .email.domain.domain not in $org_domains)

type.inbound
and sender.email.email == "noreply@alerts.elastic.co"
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "extortion" and .confidence != "low"
)

type.inbound
and (
  sender.email.domain.root_domain == "facebook.com"
  or sender.email.domain.root_domain == "facebookmail.com"
)
and 3 of (
  strings.icontains(subject.subject, "Action required"),
  strings.icontains(subject.subject, "invited to join"),
  strings.icontains(subject.subject, "partner request"),
  strings.icontains(body.current_thread.text, "You've been invited"),
  strings.icontains(body.current_thread.text, "You're invited"),
  strings.icontains(body.current_thread.text,
                    "You've received a partner request"
  ),
  strings.icontains(body.current_thread.text,
                    "not part of or affiliated with Meta"
  ),
  strings.icontains(body.current_thread.text, "Agency Partner")
)
and (
  // and the link is recently registered
  any(body.links, network.whois(.href_url.domain).days_old <= 30)
  or any(body.links,
         // if the link is still active, check if it's cred theft
         any(ml.nlu_classifier(beta.ocr(ml.link_analysis(.).screenshot).text).intents,
             .name == "cred_theft" and .confidence != "low"
         )
  )
  // or look for the legit Meta footer address
  or strings.icontains(body.current_thread.text,
                       '1 Meta Way, Menlo Park, CA 94025'
  )
)

type.inbound
and sender.email.email == "notification@facebookmail.com"
// legitimate messages from this address use Facebook as the display name
and sender.display_name != "Facebook"
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "callback_scam" and .confidence != "low"
  )
  or (
    regex.icontains(body.current_thread.text,
                    (
                      "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                    )
    )
    and (
      3 of (
        strings.ilike(body.current_thread.text, '*purchase*'),
        strings.ilike(body.current_thread.text, '*payment*'),
        strings.ilike(body.current_thread.text, '*transaction*'),
        strings.ilike(body.current_thread.text, '*subscription*'),
        strings.ilike(body.current_thread.text, '*antivirus*'),
        strings.ilike(body.current_thread.text, '*order*'),
        strings.ilike(body.current_thread.text, '*support*'),
        strings.ilike(body.current_thread.text, '*receipt*'),
        strings.ilike(body.current_thread.text, '*invoice*'),
        strings.ilike(body.current_thread.text, '*call*'),
        strings.ilike(body.current_thread.text, '*cancel*'),
        strings.ilike(body.current_thread.text, '*renew*'),
        strings.ilike(body.current_thread.text, '*refund*'),
        strings.ilike(body.current_thread.text, '*host key*')
      )
    )
    // phone number regex
    and any([body.current_thread.text, subject.subject],
            regex.icontains(strings.replace_confusables(.),
                            '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                            '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}',
                            '[\+\x{FF0B}]?(?:[0-9\x{FF10}-\x{FF19}][^0-9\x{FF10}-\x{FF19}]{0,3}){10,11}'
            )
    )
  )
)

type.inbound
and sender.email.local_part in~ ("info", "no-reply", "noreply")
and sender.email.domain.subdomain == "mg"
and (
  any(body.links,
      .href_url.domain.subdomain == "napp"
      and .href_url.domain.root_domain == sender.email.domain.root_domain
      and (
        strings.istarts_with(.href_url.path, "/campaigns/")
        or strings.istarts_with(.href_url.path, "/lists/")
      )
  )
  or strings.icontains(body.current_thread.text,
                       "12603 State Route 143 Suite G",
                       "4049 US Highway 231 #2002 Wetumpka, AL 36093"
  )
  or strings.icontains(body.current_thread.text, "[SOURCEID]")
) 

type.inbound
and sender.email.email == "no-reply@filemail.com"
and any(ml.nlu_classifier(regex.extract(body.current_thread.text,
                                        '^(?P<first_line>[^\n]+)\n'
                          )[0].named_groups["first_line"]
        ).intents,
        .name == "callback_scam" and .confidence == "high"
)

type.inbound
and sender.email.domain.domain in $free_email_providers
and any(headers.domains, .root_domain == "sendgrid.net")
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign"
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "Bounce Back and Delivery Failure Notifications"
)

type.inbound
// Legitimate GetAccept sending infrastructure
and sender.email.domain.root_domain == 'getaccept.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam"
)

type.inbound
// actual GitHub notifications
and sender.email.email == "notifications@github.com"
and all(headers.reply_to, .email.domain.domain == "reply.github.com")
and headers.return_path.email == "noreply@github.com"
// the Message-ID field will contain the unsubscribe link in the body
and strings.icontains(headers.message_id,
                      body.links[length(body.links) - 1].href_url.url
)

// negating out-of-scope notification emails from github
and not any(recipients.cc,
            .email.domain.root_domain == "github.com"
            and .email.local_part in (
              "assign",
              "comment",
              "review_requested",
              "author",
              "subscribed",
              "state_change",
              "team_mention"
            )
)

// do not match messages where the sender display name is in the org display names.
// This attempts to avoid catching internal employees commenting on org repos
and not any($org_display_names, . =~ sender.display_name)

// there is only a single external link
and length(distinct(filter(body.links,
                           // filter any links that go back to github
                           .href_url.domain.root_domain not in (
                             'github.com',
                             'githubusercontent.com',
                             'github.io',
                             'githubsupport.com',
                             'githubstatus.com'
                           )
                           // remove embedded images
                           and not (
                             strings.ends_with(.href_url.url, ".jpg")
                             or strings.ends_with(.href_url.url, "png")
                             or strings.ends_with(.href_url.url, ".svg")
                             or strings.ends_with(.href_url.url, ".gif")
                           )
                           // remove aws codesuite links
                           and not (
                             .href_url.domain.root_domain == "amazon.com"
                             and strings.istarts_with(.href_url.path,
                                                      '/codesuite/'
                             )
                           )
                    ),
                    .href_url.domain.domain
           )
) == 1

// that single link is suspicious
and any(
        // filter any links that go back to github
        filter(body.links,
               .href_url.domain.root_domain not in (
                 'github.com',
                 'githubusercontent.com',
                 'github.io',
                 'githubsupport.com',
                 'githubstatus.com'
               )
        ),
        // see if the remaining links are within several lists
        .href_url.domain.root_domain in $free_file_hosts
        or (
          .href_url.domain.root_domain in $free_subdomain_hosts
          and .href_url.domain.subdomain is not null
        )
        or .href_url.domain.root_domain in $url_shorteners
        // the domain is less than 20 days old
        or network.whois(.href_url.domain).days_old < 20
)

// The main abuse point is that they will @ multiple people in the github notification
and length(filter(body.current_thread.links,
                  strings.starts_with(.display_text, "@")
           )
) > 20

type.inbound
and length(attachments) == 0
// legitimate GoDaddy sending infrastructure
and (
  sender.email.domain.root_domain == "godaddy.com"
  and headers.auth_summary.dmarc.pass
)
and any(body.links, .display_text in~ ("Pay Now", "Accept Access"))
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in~ ("callback_scam", "cred_theft", "extortion")
        and .confidence == "high"
    )
  )
  // manual extortion indicators
  or (
    regex.icontains(sender.display_name,
                    'big(\s|[[:punct:]])?brother|seeing(\s|[[:punct:]])?eye'
    )
    or regex.icontains(body.current_thread.text,
                       '((I|you).{0,25}(leak|compromise|hack|see|record|expose))|(dirty|little) secret'
    )
  )
  // manual callback phishing indicators
  or (
    // phone number in display name or subject
    any([sender.display_name, subject.base],
        regex.icontains(.,
                        '\b\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}\b'
        )
    )
    // references commonly impersonated brands in body
    or strings.ilike(strings.replace_confusables(body.current_thread.text),
                     "*Pay?Pal*",
                     "*Best?Buy*",
                     "*Geek?Squad*",
    )
  )
  // emojis in link display text
  or any(body.links,
         regex.contains(.display_text,
                        '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
         )
  )
  // links leading to cloudflare R2 or edge services
  or any(body.links,
         .href_url.domain.root_domain in~ ("r2.dev", "pages.dev", "workers.dev")
  )
)

type.inbound
and sender.email.email == "noreply-application-integration@google.com"
and headers.auth_summary.dmarc.pass
and length(body.links) < 10
and any(body.links,
        .href_url.domain.domain in $free_file_hosts
        or .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.domain in $free_subdomain_hosts
        // Mimecast link logic
        or (
          .href_url.domain.root_domain in (
            "mimecastprotect.com",
            "mimecast.com"
          )
          and any(.href_url.query_params_decoded['domain'],
                  strings.parse_domain(.).domain in $free_file_hosts
                  or strings.parse_domain(.).root_domain in $free_file_hosts
                  or strings.parse_domain(.).root_domain in $free_subdomain_hosts
                  or . in (
                    "storage.cloud.google.com",
                    "login.microsoftonline.com"
                  )
          )
        )
        or network.whois(.href_url.domain).days_old < 30
        // abuse observed
        or .href_url.domain.root_domain == "share.google"
)