BEC: Tax document request

type.inbound
// searching for common sender emails
and sender.email.local_part in~ (
  "contact",
  "no-reply",
  "noreply",
  "info",
  "admin"
)
// sender emails unmatched
and (
  length(headers.reply_to) > 0
  and all(headers.reply_to,
          .email.domain.root_domain != sender.email.domain.root_domain
  )
)
// subject lines with words correlating to tax information
and (
  strings.icontains(subject.base, 'wage')
  or strings.icontains(strings.replace_confusables(subject.base), 'Ŵ-2')
  or regex.icontains(subject.base, 'tax (?:form|state?ment|year)')
  or regex.icontains(subject.base, '\bw-?2?\b')
  or regex.icontains(strings.replace_confusables(subject.base), '\birs\b')
)
// body text containing variations of "w2" or "wage statements"
and (
  (
    strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'Ẇ-2'
    )
    or strings.icontains(body.current_thread.text, "wage statements")
    or regex.icontains(body.current_thread.text, 'w-?2[a-z]?\b')
  )
)
// ml classifying for requests
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)
// exclude legitimate senders or domains
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign" and .confidence == "high"
)
and not (
  sender.email.domain.domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  sender.email.domain.root_domain in (
    "excel.com",
    "sharepoint.com",
    "sharepointonline.com",
    "powerpoint.com",
    "onenote.com",
    "microsoft.com",
    "jotform.com",
    "wetrasnfer.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)