Callback Phishing in body or attachment (untrusted sender)

type.inbound
and length(attachments) < 5
and (
  any(attachments,
      (.file_type in $file_types_images or .file_type == "pdf")
      and (
        any(ml.nlu_classifier(beta.ocr(.).text).intents,
            .name == "callback_scam" and .confidence in ("medium", "high")
        )
        or any(file.explode(.),

               // exclude images taken with mobile cameras and screenshots from android
               not any(.scan.exiftool.fields,
                       .key == "Model"
                       or (
                         .key == "Software"
                         and strings.starts_with(.value, "Android")
                       )
                       or (.key == "UserComment" and .value == "Screenshot")
               )
               and any(ml.nlu_classifier(.scan.ocr.raw).intents,
                       .name == "callback_scam"
                       and .confidence in ("medium", "high")
               )
        )
      )
      and (
        // negate noreply unless a logo is found in the attachment
        (
          sender.email.local_part in ("no_reply", "noreply")
          and any(ml.logo_detect(.).brands,
                  .name in ("PayPal", "Norton", "GeekSquad", "Ebay", "McAfee")
          )
        )
        or sender.email.local_part not in ("no_reply", "noreply")
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("callback_scam")
         and .confidence in ("medium", "high")
         and length(body.current_thread.text) < 1750
  )
)
and not (
  any(headers.domains, .domain == "smtp-out.gcp.bigcommerce.net")
  and strings.icontains(body.html.raw, "bigcommerce.com")
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)