Brand impersonation: MyChart

type.inbound
and (
  strings.icontains(sender.display_name, "mychart")
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "org" and strings.icontains(.text, 'mychart medicare kit')
  )
  or any(html.xpath(body.html, '//title').nodes,
         strings.icontains(.raw, 'mychart')
  )
)
and (
  (
    strings.icontains(body.current_thread.text, "mychart")
    and 2 of (
      strings.icontains(body.current_thread.text, "claim your reward"),
      strings.icontains(body.current_thread.text, "feedback survey"),
      strings.icontains(body.current_thread.text, "invited to participate"),
      strings.icontains(body.current_thread.text, "medicare kit"),
      strings.icontains(body.current_thread.text, "member rewards"),
      strings.icontains(body.current_thread.text, "member appreciation"),
      strings.icontains(body.current_thread.text, "log in to mychart"),
      strings.icontains(body.current_thread.text, 'securesign'),
      regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
    )
  )
  or strings.icontains(subject.base, "medicare kit")
  or strings.icontains(subject.base, "reward")
  or strings.icontains(subject.base, "claim")
  or regex.icontains(subject.base, '[a-f0-9]{32}\b')
  // email is an image plus a link
  or (
    coalesce(length(body.html.display_text), 0) < 100
    and length(html.xpath(body.html, '//a//img').nodes) > 0
  )
)
and not (
  sender.email.domain.root_domain in (
    "epic-notification.com",
    "moneytalksnews.com",
    "myhealthconnect.org",
    "optum.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)