Link: Personal SharePoint with invalid recipients and credential theft language

type.inbound
// undisclosed recipients or no recipients
and (
  length(recipients.to) == 0
  or (
    all(recipients.to, .email.domain.valid == false)
    and all(recipients.cc, .email.domain.valid == false)
  )
)
// no previous threads
and length(body.previous_threads) == 0
// personal SharePoint domain pattern (firstname-my.sharepoint.com or similar)
and any(body.links,
        .href_url.domain.root_domain == "sharepoint.com"
        and strings.icontains(.href_url.domain.subdomain, "-my")
)
// high confidence credential theft intent from ML
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence in ("medium", "high")
)
// and message is relatively short and contains a single link
and (
  length(body.current_thread.text) < 1500
  and length(body.current_thread.links) == 1
)