Brand impersonation: Google using Microsoft Forms

type.inbound
and sender.email.domain.domain == 'email.formspro.microsoft.com'
and regex.icontains(sender.display_name, '(google
| gmail)')
and regex.icontains(sender.display_name, '(alert
| warning
| notification)')
// MsgID does not contain Google
| Gmail
| GoogleMail
and not regex.icontains(headers.message_id,
                        '(mail
| mx)?\.?(google(mail)?
| gmail.com)'
)
and (
  any(body.links, .href_url.domain.root_domain not in $tranco_1m)
  or strings.ilike(body.html.display_text,
                   "*suspicious activities*",
                   "*failure to secure*",
                   "*loose your*",
                   "*suspended*"
  )
)