Credential phishing: Generic document share template

type.inbound
and (
  // nlu capture for wide scope of greetings to reduce evasion
  any(filter(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "greeting"
      ),
      any([
            recipients.to[0].email.domain.sld,
            recipients.to[0].email.local_part,
            recipients.to[0].email.domain.domain
          ],
          strings.icontains(body.current_thread.text,
                            strings.concat(..text, " ", .)
          )
      )
  )
  or any([
           recipients.to[0].email.domain.sld,
           recipients.to[0].email.local_part,
           recipients.to[0].email.domain.domain
         ],
         // strings logic for non-greeting body starter
         strings.icontains(body.current_thread.text,
                           strings.concat("attn: ", .)
         )
         // strings logic for recipient as starter
         or strings.icontains(body.current_thread.text,
                              strings.concat(., " balance statement")
         )
  )
  // count of all recipient elements is higher 2 or greater
  or length(filter([
                     recipients.to[0].email.domain.sld,
                     recipients.to[0].email.local_part,
                     recipients.to[0].email.domain.domain
                   ],
                   strings.icontains(body.current_thread.text, .)
            )
  ) >= 2

  // logic for broken attack
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "recipient" and regex.icontains(.text, '[{}]')
  )
)

// unicode + keyword generic template
and (
  regex.icontains(body.current_thread.text,
                  '(?:\x{270e}|\x{270f}|\x{2710}|\x{270d}|\x{1f589}|\x{1F4C4}|\x{1F4D1}|\x{1F4C1}|\x{1F4EC}).{0,15}(?:document|completion|remit|review|statement|agree|shar(?:ed|ing)|receiv|\bmail\b)',
                  '(?:document|completion|remit|review|statement|agree|shar(?:ed|ing)|receiv|\bmail\b).{0,15}(?:\x{270e}|\x{270f}|\x{2710}|\x{270d}|\x{1f589}|\x{1F4C4}|\x{1F4D1}|\x{1F4C1}|\x{1F4EC})'
  )
  // negate sharepoint paths with unicode
  and not any(body.links,
              regex.icontains(.display_url.path,
                              '(?:\x{270e}|\x{270f}|\x{2710}|\x{270d}|\x{1f589}|\x{1F4C4}|\x{1F4D1}|\x{1F4C1}|\x{1F4EC})'
              )
  )
)

// nlu negation for FP's
and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)