Attachment: Calendar invite from excessive self-reply sender

 1name: "Attachment: Calendar invite from excessive self-reply sender"
 2description: "Detect messages where there are 2 or more previous threads, where all previous messages are self-replies from the same sender, and a calendar invite attachment with a generic online-meeting location. This pattern is observed as excessive unsolicited outreach with disruptive required intervention."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // previous threads are all self-replies
 8  and (
 9    (
10      length(body.previous_threads) >= 2
11      and all(body.previous_threads, .sender.email.email == sender.email.email)
12    )
13    // negate forwarded messages
14    and not (
15      (length(headers.references) > 0 or headers.in_reply_to is not null)
16      and subject.is_forward
17    )
18  )
19  
20  // calendar invite present with generic "online location"
21  and (
22    length(attachments) > 0
23    and all(attachments,
24            (
25              .file_type == "ics"
26              or .file_extension == "ics"
27              or .content_type in ("application/ics", "text/calendar")
28            )
29            //
30            // This rule makes use of a beta feature and is subject to change without notice
31            // using the beta feature in custom rules is not suggested until it has been formally released
32            //
33            and any(beta.file.parse_ics(.).events,
34                    strings.icontains(.location, "online meeting")
35            )
36    )
37  )  
38
39attack_types:
40  - "Spam"
41tactics_and_techniques:
42  - "Social engineering"
43detection_methods:
44  - "File analysis"
45  - "Header analysis"
46  - "Content analysis"
47id: "5a9ba97f-715e-5999-84d3-b459c1eb4117"