Brand impersonation: Kroger

type.inbound
and (
  regex.icontains(sender.display_name, 'kroger\b')
  or strings.istarts_with(sender.email.local_part, 'kroger')
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any([body.current_thread.text, beta.ocr(file.message_screenshot()).text],
        strings.icontains(., 'kroger')
        and (
          strings.icontains(.,
                            'boost membership',
                            'customer number',
                            'brief online survey',
                            'points balance',
                            'fuel savings',
                            'loyalty member',
                            'start survey',
                            'special member offer',
                            'loyalty program'
          )
          or regex.icontains(., 'shopping\s?cart reward')
        )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Newsletters and Digests", "Legal and Compliance")
)
and not (
  sender.email.domain.root_domain in (
    "kroger.com",
    "krogermail.com",
    "thekrogerco.com",
    "perkspot.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)