Headers: Self-sender using Microsoft CompAuth bypass with credential theft content

type.inbound
// self sender
and length(recipients.to) == 1
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
// cred theft
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
// microsoft compauth pass, but spf and dmarc fail
and any(headers.hops, any(.fields, strings.icontains(.value, 'compauth=pass')))
and not coalesce(headers.auth_summary.dmarc.pass, false)
and not coalesce(headers.auth_summary.spf.pass, false)