Open redirect: YouTube

type.inbound
and (
  any(body.links,
      .href_url.domain.sld == "youtube"
      and (
        strings.icontains(.href_url.url, "attribution_link?")
        or .href_url.path == "/redirect"
      )
  )
  or any(attachments,
         (
           .file_extension in~ $file_extensions_macros
           or .file_extension in~ $file_extensions_common_archives
           or (
             .file_extension is null
             and .file_type == "unknown"
             and .content_type == "application/octet-stream"
             and .size < 100000000
           )
         )
         and any(file.oletools(.).relationships,
                 .name == "hyperlink"
                 and .target_url.domain.sld == "youtube"
                 and (
                   strings.icontains(.target_url.path, "attribution_link?")
                   or .target_url.path == "/redirect"
                 )
         )
  )
)
and headers.auth_summary.dmarc.details.from.root_domain == "youtube.com"

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)