Google Drive abuse: Credential phishing link

type.inbound
and sender.email.email in (
  "drive-shares-dm-noreply@google.com",
  "drive-shares-noreply@google.com"
)

// malicious observed shares don't include the google "Added you as an editor" phrase.
// allowing user edits to a malicous document could neuter the threat
and not strings.contains(body.current_thread.text, "added you as an editor")
and any(filter(body.links,
               .href_url.domain.domain != "support.google.com"
               and .display_text == "Open"
        ),
        (
          (
            ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
          )
          and length(ml.logo_detect(ml.link_analysis(., mode="aggressive").screenshot
                     ).brands
          ) > 0
        )
        or any(file.explode(ml.link_analysis(.).screenshot),
               (
                 any(ml.nlu_classifier(.scan.ocr.raw).intents,
                     .name == "cred_theft" and .confidence in ("medium", "high")
                 )
                 and (
                   length(ml.logo_detect(ml.link_analysis(..).screenshot).brands
                   ) > 0
                   and ml.link_analysis(..).credphish.disposition == "phishing"
                 )
               )
               and not ml.link_analysis(..).effective_url.domain.domain == "accounts.google.com"
               // standard Google Docs error
               and not strings.contains(.scan.ocr.raw,
                                        "encountered an error. Please try reloading this page"
               )
        )
)