Attachment: ICS calendar invite with bid/RFP lure and suspicious link

 1name: "Attachment: ICS calendar invite with bid/RFP lure and suspicious link"
 2description: "Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  regex.icontains(.description,
19                                  '(?:invite\s+(?:your\s+)?company|company\s.{0,20}invited)\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
20                                  'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
21                                  'access\s+the\s+[0-9]{4}\s+bid\s+documents',
22                                  'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
23                                  'bid\s+(?:document|package)\s*[,–-]\s*RFI',
24                                  'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
25                                  'invite.{0,20}(?:company|organization|firm|business).{0,30}(?:participate|partake).{0,30}(?:bid|proposal|RFP|RFQ|financial\s+review)',
26                                  '(?:evaluate|review|assess).{0,30}(?:proposals?|RFPs?|RFQs?).{0,30}(?:financial|accounting)',
27                                  'project\s+specifications?\s+(?:and\s+)?requirements?',
28                                  'invite.{0,30}participate.{0,50}(?:review|proposal)'
29                  )
30          )
31  )
32  and any(body.links,
33          .href_url.domain.root_domain != sender.email.domain.root_domain
34          and (
35            .href_url.domain.root_domain in $self_service_creation_platform_domains
36            or .href_url.domain.domain in $self_service_creation_platform_domains
37            or .href_url.domain.root_domain in $free_file_hosts
38            or .href_url.domain.domain in $free_file_hosts
39            or .href_url.domain.root_domain in $free_subdomain_hosts
40            or .href_url.domain.domain in $free_subdomain_hosts
41            or .href_url.domain.tld in $suspicious_tlds
42            or .href_url.domain.domain in $url_shorteners
43            or .href_url.domain.root_domain in $url_shorteners
44            or network.whois(.href_url.domain).days_old < 90
45            or regex.icontains(.display_text,
46                               '(?:review|view|open|access|download|bid)\W+(?:bid|proposal|document|rfp|rfq|tender)'
47            )
48          )
49  )  
50attack_types:
51  - "BEC/Fraud"
52  - "ICS Phishing"
53tactics_and_techniques:
54  - "Social engineering"
55  - "Free file host"
56  - "Free subdomain host"
57  - "Lookalike domain"
58detection_methods:
59  - "File analysis"
60  - "Content analysis"
61  - "URL analysis"
62  - "Whois"
63id: "e727f399-4b4f-5bc2-96bb-64129e23ee7e"