Attachment: Microsoft-branded HTML File (Unsolicited)

type.inbound

and (
    (
        not profile.by_sender_email().solicited
        and profile.by_sender_email().prevalence in ("new", "outlier")
    )
    or (
        profile.by_sender_email().any_messages_malicious_or_spam
        and not profile.by_sender_email().any_false_positives
    )
    or sender.email.domain.domain == "delivrto.me"
)

and any(attachments,
    // HTML file format
    (
        regex.imatch(.file_extension, '^[sdx]{0,1}ht[ml]{0,2}') or 
        .file_type == "html"
    )
    // Some MS branding present
    and 1 of (
        // HTML screenshot indicates MS branding
        any(ml.logo_detect(file.html_screenshot(.)).brands,
            strings.starts_with(.name, "Microsoft")
        ),
        // HTML content indicates MS branding
        any(ml.logo_detect(.).brands,
            strings.starts_with(.name, "Microsoft")
        ),
        // HTML page title is MS related
        any(file.explode(.), 
            strings.ilike(.scan.html.title, 
                "*Microsoft*", 
                "*Teams*", 
                "*One*Drive*", 
                "*Share*Point*", 
                "*Office*365*"
            )
        )
    )
)