Sublime MQL rules: tax

type.inbound
// searching for common sender emails
and sender.email.local_part in~ (
  "contact",
  "no-reply",
  "noreply",
  "info",
  "admin"
)
// sender emails unmatched
and (
  length(headers.reply_to) > 0
  and all(headers.reply_to,
          .email.domain.root_domain != sender.email.domain.root_domain
  )
)
// subject lines with words correlating to tax information
and (
  strings.icontains(subject.base, 'wage')
  or strings.icontains(strings.replace_confusables(subject.base), 'Ŵ-2')
  or regex.icontains(subject.base, 'tax (?:form|state?ment|year)')
  or regex.icontains(subject.base, '\bw-?2?\b')
  or regex.icontains(strings.replace_confusables(subject.base), '\birs\b')
)
// body text containing variations of "w2" or "wage statements"
and (
  (
    strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'Ẇ-2'
    )
    or strings.icontains(body.current_thread.text, "wage statements")
    or regex.icontains(body.current_thread.text, 'w-?2[a-z]?\b')
  )
)
// ml classifying for requests
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)
// exclude legitimate senders or domains
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign" and .confidence == "high"
)
and not (
  sender.email.domain.domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  sender.email.domain.root_domain in (
    "excel.com",
    "sharepoint.com",
    "sharepointonline.com",
    "powerpoint.com",
    "onenote.com",
    "microsoft.com",
    "jotform.com",
    "wetrasnfer.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and (
  // few links
  0 < length(body.links) < 20
  and any(body.links, network.whois(.href_url.domain).days_old <= 60)
  // fewer unique root domain links
  and length(distinct(body.links, .href_url.domain.root_domain)) < 10
  // sender domain matches no body domains
  and all(body.links,
          .href_url.domain.root_domain != sender.email.domain.root_domain
  )
)

// sender domain and return path are the same
and (sender.email.domain.root_domain == headers.return_path.domain.domain)
and not (sender.email.domain.root_domain != headers.return_path.domain.domain)
and (
  regex.icontains(subject.subject, ".*Foreign Tax*")
  or regex.icontains(subject.subject, ".*W-8BEN*")
)
// or any([body.current_thread.text, body.html.display_text, body.plain.raw],
and any([body.current_thread.text],
        regex.icontains(.,
                        'tax form',
                        'W-8BEN',
                        'Foreign Tax',
                        'tax return',
                        'tax preparation',
                        'tax documentation',
                        'regulatory',
                        'withholding',
                        'approve',
                        'non-US tax',
                        'treaty',
                        'Renew Documentation',
                        'Dear Client'
        )
)

// Registrant domain registered to China
and (
  any(body.links,
      network.whois(.href_url.domain).registrant_country_code =~ "CN"
  )
  or any(body.links,
         strings.icontains(network.whois(.href_url.domain).registrant_country,
                           "china"
         )
  )
)

// Alibaba Cloud nameservers
and all(network.whois(sender.email.domain).name_servers,
        .root_domain == "hichina.com"
)