Brand Impersonation: Procore

type.inbound
and (
  strings.ilike(body.current_thread.text, "*powered by procore*")
  or 2 of (
    strings.icontains(body.current_thread.text, 'Procore'),
    strings.icontains(body.current_thread.text, '6309 Carpinteria Ave'),
    strings.icontains(body.current_thread.text, 'Carpinteria, CA 93013')
  )
)
and not (
  sender.email.domain.root_domain in ("procore.com", "procoretech.com")
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// negating legit replies/forwards
and not (
  (
    strings.istarts_with(subject.subject, "RE:")
    or strings.istarts_with(subject.subject, "FW:")
    or strings.istarts_with(subject.subject, "FWD:")
    or regex.imatch(subject.subject,
                    '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
    )
    or strings.istarts_with(subject.subject, "Réponse automatique")
  )
  and (
    length(headers.references) > 0
    and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
  )
)
// negate bounce backs
and not (
  strings.like(sender.email.local_part,
               "*postmaster*",
               "*mailer-daemon*",
               "*administrator*"
  )
  and any(attachments,
          .content_type in (
            "message/rfc822",
            "message/delivery-status",
            "text/calendar"
          )
  )
)