BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread

type.inbound
// self sender behavior
and length(recipients.to) == 1
and length(recipients.cc) == 0
and sender.email.email == recipients.to[0].email.email

// the first link is not related to the sender
and filter(body.current_thread.links, .href_url.scheme != "mailto")[0].href_url.domain.root_domain != sender.email.domain.root_domain
// reply-to address (if present) is not related
and all(headers.reply_to,
        filter(body.current_thread.links, .href_url.scheme != "mailto")[0].href_url.domain.root_domain != .email.domain.root_domain
)
and length(body.previous_threads) > 1

// the first link's  domain does not appears in a previous thread's links
and not any(body.previous_threads,
            any(.links,
                // current link IS mimecast rewritten
                (
                  filter(body.current_thread.links,
                         .href_url.scheme != "mailto"
                  )[0].href_url.domain.root_domain in (
                    "mimecastprotect.com",
                    "mimecast.com"
                  )
                  and (
                    // the previous thread is also rewritten
                    strings.parse_domain(.href_url.query_params_decoded['domain'][0]
                    ).root_domain == strings.parse_domain(filter(body.current_thread.links,
                                                                 .href_url.scheme != "mailto"
                                                          )[0].href_url.query_params_decoded['domain'][0]
                    ).root_domain
                    // or the preiovus thread is not rewritten
                    or .href_url.domain.root_domain == strings.parse_domain(filter(body.current_thread.links,
                                                                                   .href_url.scheme != "mailto"
                                                                            )[0].href_url.query_params_decoded['domain'][0]
                    ).root_domain
                  )
                )
                // current link is NOT mimecast rewritten
                or (
                  // but the previous thread is mimecast rewritten
                  strings.parse_domain(.href_url.query_params_decoded['domain'][0]
                  ).root_domain == filter(body.current_thread.links,
                                          .href_url.scheme != "mailto"
                  )[0].href_url.domain.root_domain
                  // neither are mimecast rewritten
                  or .href_url.domain.root_domain == filter(body.current_thread.links,
                                                            .href_url.scheme != "mailto"
                  )[0].href_url.domain.root_domain
                )
            )
)

// none of the previous threads
and not any(body.previous_threads,
            // the subjet has been changed
            .subject.base =~ subject.base
            // none of the previous corrispondents are in the org_domains
            or any(flatten([.recipients.to, .recipients.bcc, .recipients.cc]),
                   .email.domain.domain in $org_domains
            )
            or .sender.email.domain.domain in $org_domains
)

// there is more than a single particiapte in the previous threads (by email and display_name)
and length(filter(flatten([
                            // pull all the sender emails from previous threads
                            map(body.previous_threads, .sender),
                            // get all the recipients from the previous threads
                            flatten(map(body.previous_threads, .recipients.to, )
                            )
                          ]
                  ),
                  // remove entries that have no email or display name
                  .email.email != ""
                  // remove enties that match the sender display name
                  and not strings.icontains(sender.display_name, .display_name)
                  // remove entires that match the sender email
                  and sender.email.email != .email.email
           // we are left with all the entries that are unrelated to the sender, there should be more than 0
           )
) > 0