Brand impersonation: Marriott with gift language

type.inbound
and (
  strings.icontains(subject.base, "marriott")
  or strings.icontains(sender.display_name, "marriott")
  or strings.ilevenshtein(sender.display_name, 'marriott') <= 2
)
and any([body.current_thread.text, subject.base],
        regex.icontains(.,
                        '(?:appreciation|thank)(?:\s|-)?(you)?\s+gift',
                        'something special',
                        'special.{0,10}thank(?:\s|-)you'
        )
)
and not (
  sender.email.domain.root_domain in~ (
    "marriott.com",
    "res-marriott.com",
    "email-marriott.com",
    "feedback-marriott.com",
    "marriotthotels.se",
    "bookonline.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)