Attachment: DocuSign Impersonation (PDF) linking to New Domain <=3d

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(ml.logo_detect(.).brands, .name == "DocuSign")
        and any(file.explode(.), any(.scan.pdf.urls, network.whois(.domain).days_old <= 3))
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
  
// excludes senders that contain "via" in the display name a resilient way
and not (
  any(headers.hops,
      any(.fields, .name == "X-Api-Host" and strings.ends_with(.value, "docusign.net"))
  )
)