Link: Microsoft protected message with suspicious recipient patterns

type.inbound
// contains the rpmsg
and any(attachments,
        .file_extension == "rpmsg"
        or .content_type == "application/x-microsoft-rpmsg-message"
)
// contains the proper link
and any(body.links,
        .href_url.domain.root_domain == "office365.com"
        and (
          strings.icontains(.href_url.query_params, "InternetMessageID=")
          or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
        )
)
and (
  // self sender 
  (
    length(recipients.to) == 1
    and recipients.to[0].email.email == sender.email.email
  )
  // no recipients at all
  or length(recipients.to) == 0
)