Brand impersonation: Adobe with suspicious language and link

type.inbound
// all attachments are images or 0 attachments
and (
  (
    length(attachments) > 0
    and all(attachments, .file_type in $file_types_images)
  )
  or length(attachments) == 0
)
and length(body.links) > 0
and (
  any(ml.logo_detect(beta.message_screenshot()).brands,
      .name == "Adobe" and .confidence in ("high")
  )
  or (
    strings.icontains(body.current_thread.text, "adobe")
    and (
      // leverage topic analysis to pick up on themes
      (
        length(beta.ml_topic(body.current_thread.text).topics) == 1
        and all(beta.ml_topic(body.current_thread.text).topics,
                .name == "File Sharing and Cloud Services"
                and .confidence != "low"
        )
      )
      // keywords if topic anlayis doesn't match
      or strings.icontains(body.current_thread.text, 'review the document')
      or strings.icontains(body.current_thread.text, 'access file')

    )
    and length(body.current_thread.text) < 2000
  )
)
and (
  any(file.explode(beta.message_screenshot()),
      strings.ilike(.scan.ocr.raw,
                    "*review*",
                    "*sign*",
                    "*view*",
                    "open",
                    "*completed document*",
                    "*open agreement*",
                    "*open document*"
      )
      and not strings.ilike(.scan.ocr.raw,
                            "*view this email*",
                            "*view*browser*",
                            "*business review*"
      )
  )
  or any(body.links,
         strings.ilike(.display_text,
                       "*review*",
                       "*sign*",
                       "*view*",
                       "open",
                       "*completed document*",
                       "*open agreement*",
                       "*open document*"
         )
         and not strings.ilike(.display_text,
                               "*view this email*",
                               "*view*browser*"
         )
  )
)
and (
  (
    (
      length(headers.references) > 0
      or not any(headers.hops,
                 any(.fields, strings.ilike(.name, "In-Reply-To"))
      )
    )
    and not (
      (
        strings.istarts_with(subject.subject, "RE:")
        or strings.istarts_with(subject.subject, "RES:")
        or strings.istarts_with(subject.subject, "R:")
        or strings.istarts_with(subject.subject, "ODG:")
        or strings.istarts_with(subject.subject, "答复:")
        or strings.istarts_with(subject.subject, "AW:")
        or strings.istarts_with(subject.subject, "TR:")
        or strings.istarts_with(subject.subject, "FWD:")
        or regex.imatch(subject.subject,
                        '^\[?/{0,2}(EXT|EXTERNAL)\]?/{0,2}[: ]\s*(RE|FWD?|FW|AW|TR|ODG|答复):.*'
        )
      )
    )
  )
  or length(headers.references) == 0
)
and (
  (
    headers.auth_summary.spf.pass
    and headers.auth_summary.dmarc.pass
    and (
      not profile.by_sender().solicited
      or profile.by_sender().any_messages_malicious_or_spam
      or profile.by_sender_email().days_since.last_contact > 14
    )
    and not profile.by_sender().any_messages_benign
    and not sender.email.domain.root_domain in ("adobe-events.com", "frame.io", "workfront.com")
  )
  or not headers.auth_summary.spf.pass
  or headers.auth_summary.spf.pass is null
  or not headers.auth_summary.dmarc.pass
  or headers.auth_summary.dmarc.pass is null
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)