Attachment: ICS calendar invite with financial lure and suspicious link

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                regex.icontains(.description,
                                'credit\s+note.{0,30}CN-[0-9]{8}',
                                '(?:review|issued?).{0,30}credit\s+note',
                                'credit.{0,20}(?:has\s+been\s+)?issued.{0,30}(?:invoice|billing|pricing\s+adjustment)',
                                '(?:billing|accounting)\s+(?:review|adjustment|reconciliation).{0,30}credit'
                )
        )
)
and any(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
        and (
          .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or .href_url.domain.tld in $suspicious_tlds
          or network.whois(.href_url.domain).days_old < 90
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $self_service_creation_platform_domains
          or .href_url.domain.domain in $self_service_creation_platform_domains
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)