type.inbound
and any(html.xpath(body.html, '//comment()').nodes,
regex.imatch(.raw, '<!--\s*[a-f0-9]{24}\s*-->')
)
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft", "bec") and .confidence != 'low'
)
Playground
Test against your own EMLs or sample data.