type.inbound
and length(body.links) > 0
and any(body.links, length(.display_text) > 3000)
and any(body.links,
regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b')
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Playground
Test against your own EMLs or sample data.