Credential phishing: Email delivery failure impersonation

type.inbound
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  or (
    length(body.current_thread.text) < 250
    and any(recipients.to,
            strings.icontains(body.current_thread.text, .email.domain.sld)
            or strings.icontains(body.current_thread.text, .email.local_part)
    )
  )
)
and (
  regex.icontains(subject.subject, '(e)?mail(s)?')
  or (
    length(body.current_thread.text) < 700
    and strings.ilike(body.current_thread.text, '*mail*')
  )
  or (length(subject.base) == 0 or subject.base is null)
)
and 3 of (
  strings.ilike(body.current_thread.text, "*incoming messages*"),
  strings.ilike(body.current_thread.text, "*server error*"),
  strings.ilike(body.current_thread.text, "*blocked*"),
  strings.ilike(body.current_thread.text, "*prevented*"),
  strings.ilike(body.current_thread.text, "*notification*"),
  strings.ilike(body.current_thread.text, "*fix email issues*"),
  strings.ilike(body.current_thread.text, "*rejected*"),
  strings.ilike(body.current_thread.text, "*recover and prevent*"),
  strings.ilike(body.current_thread.text, "*failure*"),
  strings.ilike(body.current_thread.text, "*rejection*"),
  strings.ilike(body.current_thread.text, "*failed*"),
  strings.ilike(body.current_thread.text, "*deleted in 24 hours*"),
  strings.ilike(body.current_thread.text, "*immediate attention*"),
  strings.ilike(body.current_thread.text, "*restore these messages*"),
  strings.ilike(body.current_thread.text, "*take action if needed*"),
  strings.ilike(body.current_thread.text, "*##year##*"),
  strings.ilike(body.current_thread.text, "*mail delivery subsystem*"),
  regex.icontains(body.current_thread.text,
                  '#\d+(?:\.\d+)*\s+The email account does not exist'
  )
)
and (
  any(body.links,
      regex.icontains(.display_text,
                      "view",
                      "messages",
                      "recover",
                      "fix",
                      "portal",
                      "connect",
                      "confirm"
      )
      and not .display_text == "View Report"
  )
  or (
    length(body.links) < 3
    and any(body.links,
            .mismatched
            and any(recipients.to,
                    .email.domain.root_domain == ..display_url.domain.root_domain
            )
    )
  )
  or (all(recipients.to, .email.local_part == sender.display_name))
  or any(body.links,
         any(.href_url.rewrite.encoders, . == "proofpoint")
         and .href_url.domain.root_domain not in $tranco_50k
         and .href_url.domain.root_domain not in $org_domains
  )
  or any(recipients.to,
         strings.icontains(sender.display_name,
                           strings.concat('MyReport For ', .email.local_part)
         )
  )
)
and not any(body.links,
            regex.icontains(.display_text,
                            "view document",
                            "review (&|and) sign document"
            )
)
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "office365.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com",
  "ppops.net",
  "opentext.com",
  "getsentry.com"
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and (
      not headers.auth_summary.dmarc.pass
      // MS  emails from an org domain are router "internally" to MS, therefore, there is no authentication information
      or not (
        headers.auth_summary.dmarc.pass is null
        and all(headers.domains,
                .root_domain in ("outlook.com", "office365.com")
        )
        // typical emails from freemail Outlook accounts are from prod.outlook.com
        and strings.ends_with(headers.message_id, "protection.outlook.com>")
      )
    )
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign