Microsoft infrastructure abuse with suspicious patterns

type.inbound
and sender.email.domain.root_domain == "microsoft.com"
and headers.return_path.domain.domain not in $org_domains
and 1 of (
  (
    length(recipients.to) == 1
    and all(recipients.to,
            .email.domain.root_domain == "onmicrosoft.com"
            and not .email.domain.domain in $org_domains
    )
  ),
  headers.return_path.domain.root_domain not in~ (
    'microsoft.com',
    'microsoftstoreemail.com',
    'microsoftsupport.com',
    'office.com',
    'teams-events.com',
    'qualtrics-research.com',
    'pb-dynmktg.com'
  ),
  any(headers.hops, any(.fields, .name == "Resent-From"))
)
and regex.icontains(body.current_thread.text, '\b\+?(\d{1}.)?\(?\d{3}?\)?\s~?\s?\d{3}.?~?.\d{4}\b')