type.inbound
and (
// observed unpopulated template variables in class names
any(html.xpath(body.html, "//*/@class").nodes,
regex.icontains(.raw,
'\{\s*(?:domain|email|(?:RECIPIENT|SENDER)[_\s]?EMAIL)\s*\}'
)
)
// check where class names _are_ the email address, or contain the email address are wrapped in { } or start/end with { or }
or any(recipients.to,
.email.email != ""
and any(html.xpath(body.html, "//*/@class").nodes,
.raw =~ ..email.email
or .raw =~ strings.concat("{", ..email.email, "}")
or .raw =~ strings.concat("{", ..email.email)
or .raw =~ strings.concat(..email.email, "}")
)
)
)
Playground
Test against your own EMLs or sample data.