Attachment: ICS calendar invite with bid/RFP lure and suspicious link

 1name: "Attachment: ICS calendar invite with bid/RFP lure and suspicious link"
 2description: "Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  regex.icontains(.description,
19                                  'invite\s+(?:your\s+)?company\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
20                                  'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
21                                  'access\s+the\s+[0-9]{4}\s+bid\s+documents',
22                                  'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
23                                  'bid\s+(?:document|package)\s*[,–-]\s*RFI',
24                                  'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
25                                  'invite.{0,20}(?:company|organization|firm|business).{0,30}(?:participate|partake).{0,30}(?:bid|proposal|RFP|RFQ|financial\s+review)',
26                                  '(?:evaluate|review|assess).{0,30}(?:proposals?|RFPs?|RFQs?).{0,30}(?:financial|accounting)'
27                  )
28          )
29  )
30  and any(body.links,
31          .href_url.domain.root_domain != sender.email.domain.root_domain
32          and (
33            .href_url.domain.root_domain in $self_service_creation_platform_domains
34            or .href_url.domain.domain in $self_service_creation_platform_domains
35            or .href_url.domain.root_domain in $free_file_hosts
36            or .href_url.domain.domain in $free_file_hosts
37            or .href_url.domain.root_domain in $free_subdomain_hosts
38            or .href_url.domain.domain in $free_subdomain_hosts
39            or .href_url.domain.tld in $suspicious_tlds
40            or .href_url.domain.domain in $url_shorteners
41            or .href_url.domain.root_domain in $url_shorteners
42            or network.whois(.href_url.domain).days_old < 90
43            or regex.icontains(.display_text,
44                               '(?:review|view|open|access|download)\W+(?:bid|proposal|document|rfp|rfq|tender)'
45            )
46          )
47  )  
48attack_types:
49  - "BEC/Fraud"
50  - "ICS Phishing"
51tactics_and_techniques:
52  - "Social engineering"
53  - "Free file host"
54  - "Free subdomain host"
55  - "Lookalike domain"
56detection_methods:
57  - "File analysis"
58  - "Content analysis"
59  - "URL analysis"
60  - "Whois"
61id: "e727f399-4b4f-5bc2-96bb-64129e23ee7e"