Brand impersonation: MyChart

type.inbound
and (
  strings.icontains(sender.display_name, "mychart")
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "org" and strings.icontains(.text, 'mychart medicare kit')
  )
)
and (
  (
    strings.icontains(body.current_thread.text, "mychart")
    and 2 of (
      strings.icontains(body.current_thread.text, "claim your reward"),
      strings.icontains(body.current_thread.text, "feedback survey"),
      strings.icontains(body.current_thread.text, "invited to participate"),
      strings.icontains(body.current_thread.text, "medicare kit"),
      strings.icontains(body.current_thread.text, "member rewards"),
      strings.icontains(body.current_thread.text, "member appreciation"),
      strings.icontains(body.current_thread.text, "log in to mychart"),
      regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
    )
  )
  or strings.icontains(subject.base, "medicare kit")
  or network.whois(sender.email.domain).days_old < 365
)
and not (
  sender.email.domain.root_domain in (
    "epic-notification.com",
    "myhealthconnect.org"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)