Brand impersonation: McAfee

type.inbound
and (
  regex.icontains(body.current_thread.text,
                  'McAfee.{0,30}(?:Defense|Protection)'
  )
  or regex.icontains(subject.base, 'McAfee.{0,30}(?:Defense|Protection)')
  or regex.icontains(sender.display_name,
                     '^[\s[:punct:]]*mc\s*a+f+ee+(?:$|[^,])'
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("org", "sender") and strings.icontains(.text, 'mcafee')
    )
    and length(filter(ml.nlu_classifier(body.current_thread.text).entities,
                      .name == "urgency"
               )
    ) >= 2
  )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Newsletters and Digests", "Advertising and Promotions")
            and .confidence != "low"
)
and not (
  sender.email.domain.root_domain in ('mcafee.com', 'mcafeesecure.com')
  and headers.auth_summary.dmarc.pass
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and headers.auth_summary.dmarc.pass
)