Brand impersonation: MyChart

type.inbound
and (
  strings.icontains(sender.display_name, "mychart")
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "org" and strings.icontains(.text, 'mychart medicare kit')
  )
  or (
    any(html.xpath(body.html, '//title').nodes,
        strings.icontains(.raw, 'mychart')
    )
    and any(recipients.to,
            strings.icontains(body.current_thread.text, .email.local_part)
    )
  )
)
and (
  (
    strings.icontains(body.current_thread.text, "mychart")
    and 2 of (
      strings.icontains(body.current_thread.text, "claim your reward"),
      strings.icontains(body.current_thread.text, "feedback survey"),
      strings.icontains(body.current_thread.text, "invited to participate"),
      strings.icontains(body.current_thread.text, "medicare kit"),
      strings.icontains(body.current_thread.text, "member rewards"),
      strings.icontains(body.current_thread.text, "member appreciation"),
      strings.icontains(body.current_thread.text, "log in to mychart"),
      strings.icontains(body.current_thread.text, 'securesign'),
      regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
    )
  )
  or strings.icontains(subject.base, "medicare kit")
  or regex.icontains(subject.base, '[a-f0-9]{32}\b')
  or network.whois(sender.email.domain).days_old < 365
  or sender.email.domain.root_domain in $free_email_providers
)
and not (
  sender.email.domain.root_domain in (
    "epic-notification.com",
    "myhealthconnect.org",
    "optum.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)