Reconnaissance: Email address harvesting attempt

type.inbound
and length(subject.base) <= 15
// detect email addresses in body text
and (
  regex.imatch(body.current_thread.text,
               '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
  )
)
// external freemail sender
and sender.email.domain.root_domain in $free_email_providers
// no attachments but allow one link  
and length(attachments) == 0
and length(body.current_thread.links) == 1
// negate sender profiles completely if auth is failing
and (
  (
    not (
      headers.auth_summary.dmarc.pass == false
      or headers.auth_summary.spf.pass == false
    )
    and (
      not profile.by_sender().solicited
      or (
        profile.by_sender().any_messages_malicious_or_spam
        and not profile.by_sender().any_false_positives
      )
    )
    and not profile.by_sender().any_false_positives
  )
  or (
    headers.auth_summary.dmarc.pass == false
    or headers.auth_summary.spf.pass == false
  )
)