Attachment: ICS calendar invite with bid/RFP lure and suspicious link

name: "Attachment: ICS calendar invite with bid/RFP lure and suspicious link"
description: "Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.file.parse_ics(.).events,
                  regex.icontains(.description,
                                  'invite\s+(?:your\s+)?company\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
                                  'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
                                  'access\s+the\s+[0-9]{4}\s+bid\s+documents',
                                  'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
                                  'bid\s+(?:document|package)\s*[,–-]\s*RFI',
                                  'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
                                  'invite.{0,20}(?:company|organization|firm|business).{0,30}(?:participate|partake).{0,30}(?:bid|proposal|RFP|RFQ|financial\s+review)',
                                  '(?:evaluate|review|assess).{0,30}(?:proposals?|RFPs?|RFQs?).{0,30}(?:financial|accounting)',
                                  'project\s+specifications?\s+(?:and\s+)?requirements?'
                  )
          )
  )
  and any(body.links,
          .href_url.domain.root_domain != sender.email.domain.root_domain
          and (
            .href_url.domain.root_domain in $self_service_creation_platform_domains
            or .href_url.domain.domain in $self_service_creation_platform_domains
            or .href_url.domain.root_domain in $free_file_hosts
            or .href_url.domain.domain in $free_file_hosts
            or .href_url.domain.root_domain in $free_subdomain_hosts
            or .href_url.domain.domain in $free_subdomain_hosts
            or .href_url.domain.tld in $suspicious_tlds
            or .href_url.domain.domain in $url_shorteners
            or .href_url.domain.root_domain in $url_shorteners
            or network.whois(.href_url.domain).days_old < 90
            or regex.icontains(.display_text,
                               '(?:review|view|open|access|download)\W+(?:bid|proposal|document|rfp|rfq|tender)'
            )
          )
  )
attack_types:
  - "BEC/Fraud"
  - "ICS Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Free file host"
  - "Free subdomain host"
  - "Lookalike domain"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "URL analysis"
  - "Whois"
id: "e727f399-4b4f-5bc2-96bb-64129e23ee7e"