Attachment: ICS file with credential theft indicators

 1name: "Attachment: ICS file with credential theft indicators"
 2description: "Detects inbound emails containing calendar invite (.ics) attachments where the parsed event description is classified by NLU as having high-confidence credential theft intent and financial communication topics, and where embedded links point to domains that differ from the sender's domain and match known free file hosts, free subdomain hosts, self-service creation platforms, URL shorteners, suspicious TLDs, or newly registered domains (less than 90 days old)."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  any(ml.nlu_classifier(.description).intents,
19                      .name == "cred_theft" and .confidence == "high"
20                  )
21                  and any(ml.nlu_classifier(.description).topics,
22                          .name == "Financial Communications"
23                          and .confidence != "low"
24                  )
25                  and any(.links,
26                          .href_url.domain.root_domain != sender.email.domain.root_domain
27                          and (
28                            .href_url.domain.root_domain in $self_service_creation_platform_domains
29                            or .href_url.domain.domain in $self_service_creation_platform_domains
30                            or .href_url.domain.root_domain in $free_file_hosts
31                            or .href_url.domain.domain in $free_file_hosts
32                            or .href_url.domain.root_domain in $free_subdomain_hosts
33                            or .href_url.domain.domain in $free_subdomain_hosts
34                            or .href_url.domain.tld in $suspicious_tlds
35                            or .href_url.domain.domain in $url_shorteners
36                            or .href_url.domain.root_domain in $url_shorteners
37                            or network.whois(.href_url.domain).days_old < 90
38                          )
39                  )
40          )
41  )
42  and not (
43    strings.istarts_with(subject.base,
44                         "accepted:",
45                         "declined:",
46                         "_accepted:",
47                         "_declined:"
48    )
49  )
50  and not (
51    sender.email.domain.root_domain in $high_trust_sender_root_domains
52    and coalesce(headers.auth_summary.dmarc.pass, false)
53  )  
54tags:
55  - "Attack surface reduction"
56attack_types:
57  - "ICS Phishing"
58  - "Credential Phishing"
59tactics_and_techniques:
60  - "Free file host"
61  - "Free subdomain host"
62  - "Social engineering"
63detection_methods:
64  - "File analysis"
65  - "Natural Language Understanding"
66  - "URL analysis"
67  - "Whois"
68id: "1bfa7d80-ff4c-5b82-9f3b-a58b157fb41a"