Extortion / sextortion in attachment from untrusted sender

type.inbound
and length(attachments) < 2
and (
  length(body.current_thread.text) < 500
  or (
    length(ml.nlu_classifier(body.current_thread.text).intents) > 0
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name != "benign"
    )
  )
  or regex.icontains(body.html.raw, '<img[^>]+src="cid:')
)
and any(attachments,
        // use ocr output from file.explode on pdfs/images
        (
          (.file_type in $file_types_images or .file_type == "pdf")
          and any(filter(file.explode(.), .scan.ocr.raw is not null),
                  (
                    any(ml.nlu_classifier(.scan.ocr.raw).intents,
                        .name == "extortion" and .confidence == "high"
                    )
                    and any(ml.nlu_classifier(.scan.ocr.raw).entities,
                            .name == "financial"
                    )
                  )
                  or 3 of (
                    // malware terms
                    regex.icontains(.scan.ocr.raw,
                                    "((spy
| mal)ware
| trojan
| remote control
| infiltrat(ed
| ion))"
                    ),
                    // actions recorded
                    regex.icontains(.scan.ocr.raw,
                                    "porn
| adult (web)?site
| webcam
| masturbating
| jerking off
| pleasuring yourself
| getting off"
                    ),
                    regex.icontains(.scan.ocr.raw,
                                    "pervert
| perversion
| masturbat"
                    ),
                    // a timeframe to pay
                    regex.icontains(.scan.ocr.raw,
                                    '\d\d hours',
                                    '(?:one
| two
| three) days?'
                    ),
                    // a promise from the actor
                    regex.icontains(.scan.ocr.raw,
                                    'permanently delete
| destroy (?:\w+\s*){0,4} (?:data
| evidence
| videos?)'
                    ),
                    // a threat from the actor
                    regex.icontains(.scan.ocr.raw,
                                    'sen[dt]\s*(?:\w+\s*){0,2}\s*to\s*(?:\w+\s*){0,3}\s*.{0,10}(contacts
| media
| family
| friends)'
                    ),
                    // bitcoin
                    (
                      regex.icontains(.scan.ocr.raw,
                                      'bitcoin
| \bbtc\b
| blockchain'
                      )
                      // negate cryptocurrency newsletters
                      and not (
                        any(body.links,
                            strings.icontains(.display_text, "unsubscribe")
                            and (
                              strings.icontains(.href_url.path, "unsubscribe")
                              // handle mimecast URL rewrites
                              or (
                                .href_url.domain.root_domain == 'mimecastprotect.com'
                                and strings.icontains(.href_url.query_params,
                                                      sender.email.domain.root_domain
                                )
                              )
                            )
                        )
                      )
                    ),
                    // bitcoin wallet address + threat
                    (
                      strings.icontains(.scan.ocr.raw, "contact the police")
                      and regex.icontains(.scan.ocr.raw,
                                          '(\b[13][a-km-zA-HJ-NP-Z0-9]{24,33}\b)
| \bX[1-9A-HJ-NP-Za-km-z]{33}\b
| \b(0x[a-fA-F0-9]{40})\b
| \b[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b
| \b[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b'
                      )
                    ),
                    regex.icontains(.scan.ocr.raw, 'bc1q.{0,50}\b')
                  )
          )
        )
        or 
        // use file.parse_text on plain text files
        (
          (
            .file_extension in ("txt")
            and (
              (
                any(ml.nlu_classifier(file.parse_text(.).text).intents,
                    .name == "extortion" and .confidence == "high"
                )
                and any(ml.nlu_classifier(file.parse_text(.).text).entities,
                        .name == "financial"
                )
              )
              or 3 of (
                // malware terms
                regex.icontains(file.parse_text(.).text,
                                "((spy
| mal)ware
| trojan
| remote control
| infiltrat(ed
| ion))"
                ),
                // actions recorded
                regex.icontains(file.parse_text(.).text,
                                "porn
| adult (web)?site
| webcam
| masturbating
| jerking off
| pleasuring yourself
| getting off"
                ),
                regex.icontains(file.parse_text(.).text,
                                "pervert
| perversion
| masturbat"
                ),
                // a timeframe to pay
                regex.icontains(file.parse_text(.).text,
                                '\d\d hours',
                                '(?:one
| two
| three) days?'
                ),
                // a promise from the actor
                regex.icontains(file.parse_text(.).text,
                                'permanently delete
| destroy (?:\w+\s*){0,4} (?:data
| evidence
| videos?)'
                ),
                // a threat from the actor
                regex.icontains(file.parse_text(.).text,
                                'sen[dt]\s*(?:\w+\s*){0,2}\s*to\s*(?:\w+\s*){0,3}\s*.{0,10}(contacts
| media
| family
| friends)'
                ),
                // bitcoin
                (
                  regex.icontains(file.parse_text(.).text,
                                  'bitcoin
| \bbtc\b
| blockchain'
                  )
                  // negate cryptocurrency newsletters
                  and not (
                    any(body.links,
                        strings.icontains(.display_text, "unsubscribe")
                        and (
                          strings.icontains(.href_url.path, "unsubscribe")
                          // handle mimecast URL rewrites
                          or (
                            .href_url.domain.root_domain == 'mimecastprotect.com'
                            and strings.icontains(.href_url.query_params,
                                                  sender.email.domain.root_domain
                            )
                          )
                        )
                    )
                  )
                ),
                // bitcoin wallet address + threat
                (
                  strings.icontains(file.parse_text(.).text,
                                    "contact the police"
                  )
                  and regex.icontains(file.parse_text(.).text,
                                      '(\b[13][a-km-zA-HJ-NP-Z0-9]{24,33}\b)
| \bX[1-9A-HJ-NP-Za-km-z]{33}\b
| \b(0x[a-fA-F0-9]{40})\b
| \b[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b
| \b[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b'
                  )
                ),
                regex.icontains(file.parse_text(.).text, 'bc1q.{0,50}\b')
              )
            )
          )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
  or any(headers.hops, any(.fields, .name == "X-Google-Group-Id"))

  // many extortion emails spoof sender domains and fail sender authentication
  or any(headers.hops,
         .authentication_results.dmarc == "fail"
         or .authentication_results.compauth.verdict not in ("pass", "softpass")
  )
)