Attachment: ICS voicemail lure with suspicious link

 1name: "Attachment: ICS voicemail lure with suspicious link"
 2description: "Detects inbound emails containing an ICS calendar attachment whose event description mimics a voicemail notification (e.g., 'new voicemail', 'listen to your voicemail') and includes a link pointing to a free file hosting service, self-service creation platform, URL shortener, suspicious TLD, or a domain registered within the last 90 days. Excludes messages from high-trust sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          and any(beta.file.parse_ics(.).events,
14                  // voicemail key words
15                  any([.summary, .description],
16                      regex.icontains(.,
17                                      '(?:voice\s*mail|voice\s*message|audio\s*message).{0,20}(?:notification|recording|arriv|receiv|waiting|await|pending|available|unheard|ready|logged|in\s+your|from\s+your\s+inbox)|(?:new|pending|unheard|missed|confidential)\s+(?:voice\s*mail|voice\s*message|audio\s*message)|you\s+(?:have|received)\s+a(?:\s+new\s+voice|.{0,30}voice\s*(?:mail|message))|listen\s+to\s+(?:your\s+)?voice\s*mail|listen\s+(?:to\s+)?(?:the|this|your)\s+message|message\s+to\s+listen|wireless\s*caller|audio\s*file'
18                      )
19                  )
20                  // sus link
21                  and any(.links,
22                          .href_url.domain.root_domain in $free_file_hosts
23                          or .href_url.domain.domain in $free_file_hosts
24                          or .href_url.domain.root_domain in $self_service_creation_platform_domains
25                          or .href_url.domain.domain in $self_service_creation_platform_domains
26                          or .href_url.domain.tld in $suspicious_tlds
27                          or .href_url.domain.domain in $url_shorteners
28                          or .href_url.domain.root_domain in $url_shorteners
29                          or network.whois(.href_url.domain).days_old < 90
30                          or strings.icontains(.display_url.url, "voicemail")
31                          or strings.icontains(.display_text, "voicemail", "wav")
32                          // minimal js landing page
33                          or (
34                            length(ml.link_analysis(.).unique_urls_accessed) == 3
35                            and all(ml.link_analysis(.).unique_urls_accessed,
36                                    .url == ..href_url.url
37                                    or (
38                                      strings.starts_with(.url, ..href_url.url)
39                                      and strings.ends_with(.url, '.js')
40                                    )
41                                    or .url == strings.concat(..href_url.url,
42                                                              'favicon.png'
43                                    )
44                            )
45                          )
46                  )
47          )
48  )
49  and not (
50    sender.email.domain.root_domain in $high_trust_sender_root_domains
51    and coalesce(headers.auth_summary.dmarc.pass, false)
52  )  
53attack_types:
54  - "ICS Phishing"
55  - "Credential Phishing"
56tactics_and_techniques:
57  - "Social engineering"
58  - "Free file host"
59  - "Evasion"
60detection_methods:
61  - "File analysis"
62  - "Content analysis"
63  - "URL analysis"
64  - "Whois"
65  - "Header analysis"
66id: "ef6082ce-1073-570e-b04d-abac1652ec82"