type.inbound
and any(attachments,
(.file_extension =~ "ics" or .content_type == "text/calendar")
// usage: onerror="eval(atob('
and regex.imatch(file.parse_text(.).text, ".*eval.{1,4}atob.*")
)
Playground
Test against your own EMLs or sample data.