Service Abuse: ExactTarget with suspicious sender indicators

type.inbound
and any(headers.domains, .root_domain == 'exacttarget.com')
and (
  (
    length(sender.email.email) >= 50
    and sender.email.domain.root_domain == "salesforce.com"
  )
  or sender.email.domain.root_domain == "awsapps.com"
  or strings.icontains(sender.email.domain.domain, '?utf-8')
  or regex.icontains(sender.display_name,
                     '.*\|.*(Manager|Careers|Recruitment|Specialist|Global)'
  )
)