Attachment: Calendar invite with suspicious link leading to an open redirect

 1name: "Attachment: Calendar invite with suspicious link leading to an open redirect"
 2description: "Calendar invite contains a link to either a free file host or free subdomain host, and the resulting webpage contains another link to an open redirect."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_extension == "ics"
10            or .content_type in ("application/ics", "text/calendar")
11          )
12          and any(file.explode(.),
13                  any(.scan.url.urls,
14                      (
15                        .domain.domain in $free_file_hosts
16                        or (
17                          .domain.root_domain in $free_subdomain_hosts
18                          and .domain.subdomain is not null
19                          and not (
20                            strings.ends_with(.url, "jpeg")
21                            or strings.ends_with(.url, "png")
22                          )
23                          and .domain.subdomain != "www"
24                        )
25                      )
26                      and any(ml.link_analysis(.).final_dom.links,
27                              any(.href_url.rewrite.encoders,
28                                  strings.icontains(., "open_redirect")
29                              )
30                      )
31                  )
32          )
33  )
34  // negate highly trusted sender domains unless they fail DMARC authentication
35  and not (
36    sender.email.domain.root_domain in $high_trust_sender_root_domains
37    and coalesce(headers.auth_summary.dmarc.pass, false)
38  )
39  and (
40    not profile.by_sender().solicited
41    or (
42      profile.by_sender().any_messages_malicious_or_spam
43      and not profile.by_sender().any_messages_benign
44    )
45  )
46  and not profile.by_sender().any_messages_benign  
47
48attack_types:
49  - "Spam"
50tactics_and_techniques:
51  - "Free email provider"
52  - "Free file host"
53  - "Free subdomain host"
54  - "ICS Phishing"
55  - "Open redirect"
56detection_methods:
57  - "Content analysis"
58  - "URL analysis"
59id: "5d6294c7-0b75-5722-851e-27015170bd42"