Attachment: ICS calendar with suspicious link Leading to minimal JS landing page

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(beta.file.parse_ics(.).events,
                // sus link
                any(.links,
                    (
                      .href_url.domain.root_domain in $free_file_hosts
                      or .href_url.domain.domain in $free_file_hosts
                      or .href_url.domain.root_domain in $self_service_creation_platform_domains
                      or .href_url.domain.domain in $self_service_creation_platform_domains
                      or .href_url.domain.tld in $suspicious_tlds
                      or .href_url.domain.domain in $url_shorteners
                      or .href_url.domain.root_domain in $url_shorteners
                      or network.whois(.href_url.domain).days_old < 90
                    )
                    // minimal js landing page
                    and length(filter(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                                      .url == ..href_url.url
                                      or (
                                        strings.starts_with(.url,
                                                            ..href_url.url
                                        )
                                        and regex.icontains(.url,
                                                            '[a-z]{3,}\.[0-9a-f]{20}\.js'
                                        )
                                      )
                                      or .url == strings.concat(..href_url.url,
                                                                'favicon.png'
                                      )
                               )
                    ) == 3
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)