Link: Microsoft protected message with matching sender and recipient addresses

type.inbound
// contains the rpmsg
and any(attachments,
        .file_extension == "rpmsg"
        or .content_type == "application/x-microsoft-rpmsg-message"
)
// contains the proper link
and any(body.links,
        .href_url.domain.root_domain == "office365.com"
        and (
          strings.icontains(.href_url.query_params, "InternetMessageID=")
          or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
        )
)
// the To and From headers are the same
and length(recipients.to) == 1
and all(recipients.to, .email.email == sender.email.email)