Brand impersonation: SiriusXM

type.inbound
and (
  regex.icontains(sender.display_name, 'sirius[._-]?xm')
  or strings.ilevenshtein(sender.display_name, 'siriusxm') <= 1
  or strings.ilike(sender.email.domain.domain, '*siriusxm*')
  or (
    strings.istarts_with(body.current_thread.text, 'sirius xm')
    and regex.contains(body.current_thread.text,
                       '[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]'
    )
  )
)
and (
  sender.email.domain.root_domain not in (
    'siriusxm.com',
    'siriusxmmedia.com',
    'siriusxm.ca',
    'engagement360.net', // SiriusXM survey vendor
    'sciquest.com' // SiriusXM Procurement
  )
  or (
    sender.email.domain.root_domain in (
      'siriusxm.com',
      'siriusxmmedia.com',
      'siriusxm.ca',
      'engagement360.net', // SiriusXM survey vendor
      'sciquest.com' // SiriusXM Procurement
    )
    and not headers.auth_summary.dmarc.pass
  )
)
and not profile.by_sender().solicited
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)