Rspamd supports operators between patterns. Here's an example from my
regexp.conf:
WA_LISTERV_EMAIL_STORM {
re = 'To=/@listserv\..*\.wa\.gov/i{header} &&
(!From=/\.wa\.gov/i{header} ||
From=/dmarc-request at listserv\..*\.wa\.gov/i{header})',
score = 20,
description = 'Replies to Washington State mailing lists',
}
Andy