Link: Free file host from freemail sender with NLU intent

type.inbound

// short body
and length(body.current_thread.text) < 500

// NLU intent
and (
  any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
  and length(ml.nlu_classifier(body.current_thread.text).intents) > 0
)

// free file host link
and any(body.links,
        .href_url.domain.domain in $free_file_hosts
        or .href_url.domain.root_domain in $free_file_hosts
)

// freemail sender
and sender.email.domain.root_domain in $free_email_providers
and (
  not profile.by_sender().any_false_positives
  and not profile.by_sender().solicited
)