Attachment: ICS file with credential theft indicators

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(ml.nlu_classifier(.description).intents,
                    .name == "cred_theft" and .confidence == "high"
                )
                and any(ml.nlu_classifier(.description).topics,
                        .name == "Financial Communications"
                        and .confidence != "low"
                )
                and any(.links,
                        .href_url.domain.root_domain != sender.email.domain.root_domain
                        and (
                          .href_url.domain.root_domain in $self_service_creation_platform_domains
                          or .href_url.domain.domain in $self_service_creation_platform_domains
                          or .href_url.domain.root_domain in $free_file_hosts
                          or .href_url.domain.domain in $free_file_hosts
                          or .href_url.domain.root_domain in $free_subdomain_hosts
                          or .href_url.domain.domain in $free_subdomain_hosts
                          or .href_url.domain.tld in $suspicious_tlds
                          or .href_url.domain.domain in $url_shorteners
                          or .href_url.domain.root_domain in $url_shorteners
                          or network.whois(.href_url.domain).days_old < 90
                        )
                )
        )
)
and not (
  strings.istarts_with(subject.base,
                       "accepted:",
                       "declined:",
                       "_accepted:",
                       "_declined:"
  )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)