Service abuse: Soundestlink.com Microsoft impersonation

type.inbound
and (
  // parsed urls
  any(body.links,
      (
        .href_url.domain.root_domain == "soundestlink.com"
        and regex.icontains(.href_url.domain.subdomain,
                            '(?:microsoft|teams|login|office|365|outlook)'
        )
      )
      // handle mimecast
      or (
        .href_url.domain.root_domain in ("mimecastprotect.com", "mimecast.com")
        and any(.href_url.query_params_decoded['domain'],
                strings.parse_domain(.).root_domain == "soundestlink.com"
                and regex.icontains(strings.parse_domain(.).subdomain,
                                    '(?:microsoft|teams|login|office|365|outlook)'
                )
        )
      )
  )
  // unparsed and extracted
  or (
    strings.icontains(body.html.display_text, 'soundestlink.com')
    and any(regex.extract(body.html.display_text,
                          '(?P<domain>[a-z0-9.\-]+\.soundestlink\.com)'
            ),
            regex.icontains(strings.parse_domain(.named_groups["domain"]).subdomain,
                            '(?:microsoft|teams|login|office|365|outlook)'
            )
    )
  )
)