Sender name contains Active Directory distinguished name

type.inbound
and (
  regex.icontains(sender.display_name, '\b(EX|LABS|OU|CN|EXCHANGE)(=|/)')
  or strings.icontains(sender.display_name, "/O=EXCHANGELABS")
)
and sender.email.domain.root_domain not in $org_domains
and not (
  sender.email.domain.root_domain in ('fnfcorp.com')
  and headers.auth_summary.dmarc.pass
)