Link: Apple App Store malicious ad manager themed apps from free email provider

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain in ('apps.apple.com')
                and regex.icount(.href_url.path,
                                 '[/-](?:suite|ads?|manager?|campaigns?)'
                ) >= 2
        )
and sender.email.domain.domain in $free_email_providers