Callback Phishing in body or attachment (untrusted sender)

type.inbound
and length(attachments) < 5
and (
  any(attachments,
      (.file_type in $file_types_images or .file_type == "pdf")
      and any(file.explode(.),

              // exclude images taken with mobile cameras and screenshots from android
              not any(.scan.exiftool.fields,
                      .key == "Model"
                      or (
                        .key == "Software"
                        and strings.starts_with(.value, "Android")
                      )
                      or (.key == "UserComment" and .value == "Screenshot")
              )
              and any(ml.nlu_classifier(.scan.ocr.raw).intents,
                      .name == "callback_scam" and .confidence == "high"
              )
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("callback_scam")
         and .confidence == "high"
         and length(body.current_thread.text) < 1500
  )
)
and not (
  any(headers.domains, .domain == "smtp-out.gcp.bigcommerce.net")
  and strings.icontains(body.html.raw, "bigcommerce.com")
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)