Brand impersonation: Aconex

type.inbound
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("org", "sender") and strings.icontains(.text, 'Aconex')
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "cred_theft" and .confidence != "low"
    )
  )
  or (
    strings.icontains(body.current_thread.text, 'Aconex')
    and 2 of (
      strings.icontains(body.current_thread.text, 'Support Central'),
      strings.icontains(body.current_thread.text,
                        'This email is automatically generated'
      ),
      regex.icontains(body.current_thread.text, 'Mail Number'),
      regex.icontains(body.current_thread.text, 'Reference Number')
    )
  )
)
and not (
  sender.email.domain.root_domain in ("oracle.com", "aconex.com")
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)