Brand impersonation: Microsoft logo image linking to free file host

type.inbound
and any(map(filter(attachments,
                   .file_type in $file_types_images
                   and .content_disposition =~ "inline"
                   and any(ml.logo_detect(.).brands,
                           strings.istarts_with(.name, "Microsoft")
                           and .confidence == "high"
                   )
                   // big image
                   and beta.parse_exif(.).image_height > 96
                   and beta.parse_exif(.).image_width > 96
                   // and there is text on the image
                   and regex.icount(beta.ocr(.).text, '\w+\W') > 5
            ),
            .content_id
        ),
        // that image is used a a link in the body
        any(html.xpath(body.html, '//a[.//img[@src]]').nodes,
            strings.icontains(.raw, ..)
            and any(.links,
                    // the link goes to self_service for free_file_hosts
                    (
                      .href_url.domain.domain in $self_service_creation_platform_domains
                      or .href_url.domain.root_domain in $self_service_creation_platform_domains
                      or .href_url.domain.domain in $free_file_hosts
                      or .href_url.domain.root_domain in $free_file_hosts
                    )
                    // but not sharepoint
                    and not .href_url.domain.domain in $tenant_domains
            )
        )
)