Impersonation: Recipient SLD in sender's email address local part

type.inbound
// check that there's at least 1 sus attachment, link, or body text
and (
  length(attachments) > 0
  // this must be run in user environments to not flag,
  // not the Analyzer
  or any(body.links, .href_url.domain.domain not in $org_domains)
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name != "benign" and .confidence == "high"
  )
)
and (
  any(recipients.to,
      (
        strings.contains(sender.email.local_part, .email.domain.sld)
        // checking to ensure no FPs, like "me" in "me.com"
        and length(.email.domain.sld) > 3
      )
  )
)
// negating listservs
and not (
    any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
    and strings.contains(sender.display_name, "via")
)
and sender.email.domain.root_domain not in $org_domains
and sender.email.domain.root_domain not in  ("medallia.com", "icims.com", "workday.com")
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_false_positives
  )
)