Suspicious recipients pattern with no Compauth pass and suspicious content

type.inbound
and (
  length(recipients.to) == 0
  or all(recipients.to, .display_name == "Undisclosed recipients")
)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and 2 of (
  (
    any(headers.hops,
        .authentication_results.compauth.verdict is not null
        and .authentication_results.compauth.verdict not in ("pass", "softpass")
    )
  ),
  (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("bec", "cred_theft", "advance_fee") and .confidence == "high"
    )
  ),
  (
    any(body.links,
        any([ml.link_analysis(.)],
            .credphish.disposition == "phishing"
            and .credphish.confidence in ("high")
        )
    )
  )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)