Cloud storage impersonation with credential theft indicators

type.inbound
and (
  0 < length(body.current_thread.links) < 10
  or length(body.current_thread.links) > 100
)
and any([subject.subject, sender.display_name],
        regex.icontains(.,
                        "(?:cloud
| storage
| mailbox
| account
| system
| service
| ^data)"
        )
)
and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
        .name == "cred_theft" and .confidence == "high"
)
and not any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
            .name == "Customer Service and Support" and .confidence == "high"
)
and regex.icontains(beta.ocr(file.message_screenshot()).text,
                    "storage.{0,50}full",
                    "free.{0,50}upgrade",
                    "storage.{0,50}details",
                    "storage.{0,50}quot",
                    "(?:mailbox
| account
| cloud).{0,50}(?:at risk
| storage
| disabled)",
                    '\d{2}%\s*capacity',
                    "data.{0,20}(?:removal
| purge
| protection mode)",
                    "billing.{0,20}suspended"
)
and not strings.ilike(beta.ocr(file.message_screenshot()).text, "*free plan*")
and (
  any(body.current_thread.links,
      // fingerprints of a hyperlinked image
      .display_text is null
      and .display_url.url is null
      and .href_url.domain.domain not in $tenant_domains
      and (
        .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.root_domain in $url_shorteners
        or network.whois(.href_url.domain).days_old < 365
        or .href_url.domain.root_domain == "beehiiv.com"
        or regex.icontains(.href_url.path, '^\/[a-z0-9]{20,}$')
        or (
          strings.icontains(.href_url.path, '.html')
          and coalesce(.href_url.domain.root_domain, "null") != coalesce(sender.email.domain.root_domain,
                                                                         ""
          )
        )
        or "google_adservices" in .href_url.rewrite.encoders
      )
  )
)
// and the sender is not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)