Service abuse: SendGrid impersonation via Sendgrid from new sender

type.inbound
// SendGird impersonation patterns
and (
  strings.ilike(strings.replace_confusables(sender.display_name), '*sendgrid*')
  or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                          'sendgrid'
  ) <= 1
  or (
    strings.ilike(strings.replace_confusables(sender.email.local_part),
                  '*sendgrid*'
    )
    and (
      sender.display_name is null
      or strings.ilike(strings.replace_confusables(subject.base),
                       '*sendgrid*'
      )
    )
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         .name == "SendGrid" and .confidence == "high"
  )
)
// sent from sendgrid infra
and any(headers.domains,
        strings.icontains(.domain, 'outbound-mail.sendgrid.net')
)
// new senders only
and profile.by_sender_email().prevalence == "new"

// negate legit sendgrid messages
and not (
    sender.email.domain.domain == "sendgrid.com"
    and coalesce(headers.auth_summary.dmarc.pass, false)
)