Credential theft with 'safe content' deception and social engineering topics

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
and (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name in (
        "Reminders and Notifications",
        "Secure Message",
        "Security and Authentication",
        "Voicemail Call and Missed Call Notifications",
        "E-Signature",
        "Financial Communications"
      )
  )
  or (
    length(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                           .name not in ("org", "recipient", "sender")
                    ),
                    .name
           )
    ) > 0
    and all(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                            .name not in ("org", "recipient", "sender")
                     ),
                     .name
            ),
            .name in ("request", "financial", "urgency")
    )
  )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in (
              "Advertising and Promotions",
              "Newsletters and Digests",
              "News and Current Events",
              "Travel and Transportation"
            )
)
// check only the first line of the email
and any(regex.iextract(body.current_thread.text, "^[^\r\n]*"),
        length(.full_match) < 500
        and strings.ilike(.full_match,
                          "*safe content*",
                          "*safe sender*",
                          "*trusted sender*"
        )
        and not regex.icontains(.full_match,
                                "add.{0,50} to.{0,50}(address book|safe senders? list)"
        )
)