Attachment: ICS calendar file with real estate fraud link

 1name: "Attachment: ICS calendar file with real estate fraud link"
 2description: "Detects calendar files (.ics files) whose parsed event content references real estate transaction documents such as closing disclosures, settlement statements, or 1099-S forms."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  (
19                    any([.summary, .description],
20                        regex.icontains(.,
21                                        'file attached',
22                                        '\brefer\b',
23                                        '\brespon(?:d|se)\b',
24                                        '\breview\b'
25                        )
26                    )
27                    or any(.links, regex.icontains(.display_text, 'view'))
28                  )
29                  and (
30                    any([.summary, .description],
31                        regex.icontains(., "1099-s", "draw settlement")
32                    )
33                    or any([.summary, .description],
34                           length(.) < 2000
35                           and regex.icontains(.,
36                                               '(?:attached|buyer/seller|new|preliminary).closing disclosure',
37                                               'settlement.(?:&|and.)?(?:report|statement)'
38                           )
39                    )
40                  )
41          )
42  )  
43
44attack_types:
45  - "BEC/Fraud"
46tactics_and_techniques:
47  - "Social engineering"
48  - "Evasion"
49detection_methods:
50  - "File analysis"
51  - "Content analysis"
52  - "URL analysis"
53id: "1ff7696f-2e6d-5967-a46c-abf00d7d67a9"