Attachment: ICS calendar invite with photo/file share lure

type.inbound
and sender.email.domain.root_domain in $free_email_providers
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // this rule makes use of a beta feature and is subject to change without notice
        // parse the ICS and read the payload the calendar client renders, not the
        // (obfuscatable / image-rendered) html body
        //
        and any(beta.file.parse_ics(.).events,
                // calendar invite contains file sharing language in the description of the invite
                // just-in-case addition of a regex match on stuff like "shared a folder"
                (
                  any(ml.nlu_classifier(.description).topics,
                      .name == 'File Sharing and Cloud Services'
                  )
                  or regex.icontains(.description,
                                     "shared (?:a|an) (?:folder|photo|album|picture|image|file|doc) with you"
                  )
                )
                // outlook "groups" self-invite (organizer is a long-numeric groups.outlook.com mailbox)
                // or the "View photo" cta routes through a google redirector (share.google / search.app)
                // rather than drive.google.com
                and (
                  .organizer.email.domain.domain == "groups.outlook.com"
                  or any(.links,
                         .href_url.domain.tld == "google"
                         or .href_url.domain.root_domain == "search.app"
                  )
                )
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)