Impersonation: Employee using fabricated identity in initial contact

type.inbound
// not a reply thread — this is initial contact
and length(headers.references) == 0
// short body, no attachments — initial contact social engineering
and length(body.current_thread.text) < 500
and length(attachments) == 0
// contains basic greeting
and any(["Hey", "Hi", "Hello"],
        strings.starts_with(body.current_thread.text,
                            strings.concat(.,
                                           " ",
                                           regex.extract(subject.base,
                                                         '^\P{L}*([\p{L}''-]+)'
                                           )[0].groups[0],
                                           ",\n"
                            )
        )
)
// ends with the senders display name
and strings.ends_with(body.current_thread.text,
                      strings.concat("\n", sender.display_name, ".")
)
// sender display name not in the actual email address local part
and any(regex.iextract(sender.display_name, '\w+'),
        .full_match not in~ (sender.email.local_part)
)