Credential phishing: Generic document share with unicode and proceedural greeting template

type.inbound
and (
  // nlu capture for wide scope of greetings to reduce evasion
  any(filter(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "greeting"
      ),
      any([
            recipients.to[0].email.domain.sld,
            recipients.to[0].email.local_part,
            recipients.to[0].email.domain.domain,
            // "firstlast" naming convention observed
            strings.concat(mailbox.first_name, mailbox.last_name)
          ],
          // recipient entity follows the greeting in the body text
          strings.icontains(body.current_thread.text,
                            strings.concat(..text, " ", .)
          )
      )
  )
  or (
    // nlu capture for wide scope of greetings to reduce evasion
    any(filter(ml.nlu_classifier(body.current_thread.text).entities,
               .name == "greeting"
        ),
        // nlu capture for wide scope of recipient entity to reduce evasion
        any(filter(ml.nlu_classifier(body.current_thread.text).entities,
                   .name == "recipient"
                   and not (
                     strings.icontains(.text, "customer")
                     // accounting for grouped recipients
                     or regex.icontains(.text, '&|\band\b')
                   )
            ),
            // recipient entity follows the greeting in the body text
            strings.icontains(body.current_thread.text,
                              strings.concat(..text, " ", .text)
            )
            // the named recipient doesn't match the actual "to" recipient
            and not any([
                          recipients.to[0].email.domain.sld,
                          recipients.to[0].email.local_part,
                          recipients.to[0].email.domain.domain,
                          mailbox.first_name,
                        ],
                        strings.icontains(..text, .)
            )
        )
    )
  )
  or any([
           recipients.to[0].email.domain.sld,
           recipients.to[0].email.local_part,
           recipients.to[0].email.domain.domain,
           // "firstlast" naming convention observed
           strings.concat(mailbox.first_name, mailbox.last_name)
         ],
         // strings logic for non-greeting body starter
         strings.icontains(body.current_thread.text,
                           strings.concat("attn: ", .)
         )
         // strings logic for recipient as body starter
         or strings.icontains(body.current_thread.text,
                              strings.concat(., " balance statement")
         )
  )
  // count of all recipient elements is 2 or greater
  or length(filter([
                     recipients.to[0].email.domain.sld,
                     recipients.to[0].email.local_part,
                     recipients.to[0].email.domain.domain,
                     // "firstlast" naming convention observed
                     strings.concat(mailbox.first_name, mailbox.last_name)
                   ],
                   strings.icontains(body.current_thread.text, .)
            )
  ) >= 2

  // logic for broken attack
  or any(ml.nlu_classifier(body.current_thread.text).entities,
         .name == "recipient" and regex.icontains(.text, '[{}]')
  )
)

// unicode + keyword generic template
and (
  (
    (
      regex.icontains(body.current_thread.text,
                      '(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})\n?.{0,15}(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)',
                      '(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)\n?.{0,15}(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
      )
      // negate sharepoint paths with unicode
      and not any(body.links,
                  regex.icontains(.display_url.path,
                                  '(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
                  )
      )
    )
    // start of body is unicode & CTA button is present
    or (
      regex.icontains(body.current_thread.text,
                      '^(?:\x{2710}|\x{270D}|\x{270E}|\x{270F}|\x{1F4C1}|\x{1F4C4}|\x{1F4D1}|\x{1F4DD})'
      )
      and any(body.links,
              regex.icontains(.display_text,
                              '(?:document|completion|remit|review|statement|agreement|shar(?:ed|ing)|receiv|\bmail\b)'
              )
      )
    )
  )
)

// strings negations
and not regex.icontains(body.current_thread.text,
                        'meeting (?:note|recap)|daily brief|brief recap'
)

// nlu intent negation for FP's
and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")

// nlu topic negations
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Software and App Updates", "B2B Cold Outreach")
)

// negate multiple recipients unless undisclosed recipients
and not (
  length(recipients.to) == 1
  and (
    (length(recipients.cc) != 0 or length(recipients.bcc) != 0)
    // notification automation
    and not any(recipients.bcc, .email.local_part == "notifications")
  )
  and not (
    length(recipients.to) == 0
    or all(recipients.to, .email.domain.valid == false)
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// negate legitimate conversations
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)

// sender negations
and not (
  sender.email.domain.root_domain in (
    "gc.ai",
    "getguru.com",
    "glean.com",
    "mentorloop.com",
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)