VIP / Executive impersonation (strict match, untrusted)

type.inbound
and (
  // the display name matches a name on the orgs vip list
  any($org_vips, .display_name =~ sender.display_name)
  // or the display name starts with the name on the orgs vip list
  or (
    any($org_vips,
        strings.istarts_with(sender.display_name, .display_name)
        // and it is longer than just their name (eg. John Doe CEO)
        and length(sender.display_name) > length(.display_name)
    )
    // and we have confidence it's BEC
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "bec" and .confidence == "high"
    )
  )
)
and (
  // ignore personal <> work emails
  // where the sender and mailbox's display name are the same
  length(recipients.to) > 0
  or length(recipients.cc) > 0
  or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)
and not any(attachments,
            .content_type in (
              "message/rfc822",
              "message/delivery-status",
              "text/calendar"
            )
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)
and not profile.by_sender().any_messages_benign