Sendgrid onmicrosoft.com domain phishing

type.inbound
and headers.return_path.domain.domain == "sendgrid.net"
and sender.email.domain.root_domain == "onmicrosoft.com"
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)