Service Abuse: Box file sharing with credential phishing intent

type.inbound

// Legitimate Box sending infrastructure
and sender.email.domain.root_domain == "box.com"

// ML classification indicates credential theft with high confidence
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  // Link analysis for credential phishing detection
  or any(filter(body.links,
                // target the box link
                (
                  .href_url.domain.domain == "app.box.com"
                )
         ),
         ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
         and ml.link_analysis(., mode="aggressive").credphish.confidence in (
           "medium",
           "high"
         )
  )
)
// Box file sharing patterns
and (
  strings.icontains(subject.subject, 'invited you to')
  or strings.icontains(subject.subject, 'shared')
  or strings.icontains(subject.subject, 'has sent you')
  or strings.icontains(body.current_thread.text, 'Go to File')
  or any(body.links, strings.icontains(.display_text, 'Go to File'))
)

// Suspicious document patterns or VIP impersonation
and (
  // Financial document patterns
  (
    regex.icontains(subject.subject,
                    '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or regex.icontains(body.current_thread.text,
                       '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or any(body.links,
           regex.icontains(.display_text,
                           '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
           )
    )
  )
  // Corporate document patterns
  or (
    regex.icontains(subject.subject,
                    '\b(urgent|important|confidential|secure|encrypted|document|file)\b'
    )
    and regex.icontains(subject.subject,
                        '\b(review|approval|signature|verification|validation)\b'
    )
  )
)