Brand impersonation: Microsoft Teams

type.inbound
and length(filter(attachments,
                  .file_type in $file_types_images or .file_type == "pdf"
           )
) < 10
and any(attachments,
        (.file_type in $file_types_images or .file_type == "pdf")
        and any(file.explode(.),
                regex.icontains(.scan.ocr.raw,
                                "trying to reach you.*microsoft teams"
                )
        )
)
and sender.email.domain.root_domain not in (
  "microsoft.com",
  "microsoftsupport.com",
  "office.com"
)