Link: Microsoft device code authentication with suspicious indicators

type.inbound
and length(recipients.to) == 1
and 0 < length(body.links) < 15
and any(body.links,
        // strings commonly observed in the microsoft device code phishing lure
        regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
                        "verification co(?:mplete
| de)",
                        '\bcopy code\b',
                        "Secured by Microsoft",
                        "(?:redirecting to
| opening) your document",
                        "preparing verification",
                        "(?:verify your identity
| complete verification) with Microsoft"
        )
        // unique device code antibot token cookie, api path, ms device login path url
        and (
          regex.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                          'X-Antibot-Token',
                          '\/api\/device\/sta(?:rt
| tus)\/',
                          'microsoft\.com\/devicelogin'
          )
          // or api path on workers dev associated with this activity
          or any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                 strings.icontains(.path, '/api/device/start')
                 and strings.icontains(.domain.root_domain, 'workers.dev')
          )
        )
)