Service abuse: Callback phishing via Microsoft Teams invite

type.inbound
and sender.email.domain.domain == "teams.mail.microsoft"
// MS Teams invite indicators
and (
  any(body.links,
      .display_text == "Open Microsoft Teams"
      and (
        .href_url.domain.domain == "login.microsoftonline.com"
        or strings.iends_with(.href_url.query_params,
                              "login.microsoftonline.com"
        )
      )
  )
)
and (
  (
    regex.icontains(strings.replace_confusables(body.current_thread.text),
                    (
                      "mcafee|norton|geek.{0,5}squad|pay.?pal|ebay|symantec|best buy|lifelock|(ms|microsoft|teams).{0,10}premium"
                    )
    )
    or 3 of (
      strings.ilike(body.current_thread.text, '*purchase*'),
      strings.ilike(body.current_thread.text, '*p?ym?nt*'),
      strings.ilike(body.current_thread.text, '*transaction*'),
      strings.ilike(body.current_thread.text, '*subscription*'),
      strings.ilike(body.current_thread.text, '*antivirus*'),
      strings.ilike(body.current_thread.text, '*order*'),
      strings.ilike(body.current_thread.text, '*support*'),
      strings.ilike(body.current_thread.text, '*help line*'),
      strings.ilike(body.current_thread.text, '*receipt*'),
      strings.ilike(body.current_thread.text, '*c?ntact*'),
      strings.ilike(body.current_thread.text, '*cancel*'),
      strings.ilike(body.current_thread.text, '*renew*'),
      strings.ilike(body.current_thread.text, '*refund*'),
      strings.ilike(body.current_thread.text, '*billing*'),
      regex.icontains(body.current_thread.text, '[li]nv.[li]ce')
    )
  )
  // phone number regex
  and any([body.current_thread.text, subject.subject],
          regex.icontains(.,
                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}'
          )
  )
)