Credential Phishing: Hyper-linked image leading to free file host

type.inbound
and length(body.links) > 0
and 0 < length(attachments) < 8
and all(attachments, .file_type in $file_types_images and .size > 2000)
and any(body.links,
        // fingerprints of a hyperlinked image
        .display_text is null
        and .display_url.url is null
        and .href_url.domain.root_domain in $free_file_hosts
)
and (
  // body text is very short
  (
    0 <= (length(body.current_thread.text)) < 10
    or body.current_thread.text is null
  )
  or (
    length(body.current_thread.text) < 900
    // or body is most likely all warning banner (text contains the sender and common warning banner language)
    and (
      (
        strings.contains(body.current_thread.text, sender.email.email)
        and strings.contains(body.current_thread.text, 'caution')
      )
      or regex.icontains(body.current_thread.text,
                         "intended recipient's use only|external email|sent from outside|you don't often|confidential"
      )
    )
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

// not solicited or previously flagged malicious/spam
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)

// negate legitimate canva emails
and not (
  strings.contains(sender.display_name, "via Canva")
  and sender.email.domain.domain == "canva.com"
  and (
    any(distinct(headers.hops, .authentication_results.dmarc is not null),
        strings.ilike(.authentication_results.dmarc, "*pass")
    )
  )
)