Attachment: ICS calendar invite with bid/RFP lure and suspicious link

 1name: "Attachment: ICS calendar invite with bid/RFP lure and suspicious link"
 2description: "Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  regex.icontains(.description,
19                                  '(?:invite\s+(?:your\s+)?company|company\s.{0,20}invited)\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
20                                  'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
21                                  'access\s+the\s+[0-9]{4}\s+bid\s+documents',
22                                  'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
23                                  'bid\s+(?:document|package)\s*[,–-]\s*RFI',
24                                  'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
25                                  'invite.{0,20}(?:company|organization|firm|business).{0,30}(?:participate|partake).{0,30}(?:bid|proposal|RFP|RFQ|financial\s+review)',
26                                  '(?:evaluate|review|assess).{0,30}(?:proposals?|RFPs?|RFQs?).{0,30}(?:financial|accounting)',
27                                  'project\s+specifications?\s+(?:and\s+)?requirements?',
28                                  'invite.{0,30}participate.{0,50}(?:review|proposal)',
29                                  'prepare\s+your\s+(?:quote|bid|proposal)'
30                  )
31          )
32  )
33  and any(body.links,
34          .href_url.domain.root_domain != sender.email.domain.root_domain
35          and (
36            .href_url.domain.root_domain in $self_service_creation_platform_domains
37            or .href_url.domain.domain in $self_service_creation_platform_domains
38            or .href_url.domain.root_domain in $free_file_hosts
39            or .href_url.domain.domain in $free_file_hosts
40            or .href_url.domain.root_domain in $free_subdomain_hosts
41            or .href_url.domain.domain in $free_subdomain_hosts
42            or .href_url.domain.tld in $suspicious_tlds
43            or .href_url.domain.domain in $url_shorteners
44            or .href_url.domain.root_domain in $url_shorteners
45            or network.whois(.href_url.domain).days_old < 90
46            or any(.href_url.rewrite.encoders,
47                   strings.icontains(., "open_redirect")
48            )
49            or regex.icontains(.display_text,
50                               '(?:review|view|open|access|download|bid)\W+(?:bid|proposal|document|rfp|rfq|tender)'
51            )
52          )
53  )  
54attack_types:
55  - "BEC/Fraud"
56  - "ICS Phishing"
57tactics_and_techniques:
58  - "Social engineering"
59  - "Free file host"
60  - "Free subdomain host"
61  - "Lookalike domain"
62detection_methods:
63  - "File analysis"
64  - "Content analysis"
65  - "URL analysis"
66  - "Whois"
67id: "e727f399-4b4f-5bc2-96bb-64129e23ee7e"