Brand impersonation: Office 365 mail service

type.inbound
and (
  strings.icontains(sender.email.domain.sld, 'o365')
  or strings.icontains(sender.email.domain.sld, 'outlook')
  or strings.icontains(sender.email.domain.sld, 'office')
)
and strings.icontains(sender.email.domain.sld, 'mail')
// not benign use cases
and not (
  sender.email.domain.root_domain in (
    "agentofficemail.com", // mandrill app addon
    "mdofficemail.com", // doctor office
    "medofficemail.com", // doctor office
    "officemailbox.fr", // bulk mail provider
    "mail-office.fr", // bulk mail provider
    "officedepot-mail.co.kr", // office depot in kr
    "emailmarketdataoutlook.com", // email mrkting 
    "officelabsmail.co.uk" // company in the uk
  )
  and headers.auth_summary.dmarc.pass
)

False Positives

• ⚠ It is possible for this to match in benign domains. For recurring benign senders, apply sender exclusions to prevent unnecessary matches.