Attachment: ICS Link With Valueless Base64 Query Parameter

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(.links,
                    (
                      .href_url.path == '/'
                      and regex.imatch(.href_url.query_params,
                                       '[A-Za-z0-9+/]{8}'
                      )
                      and length(.href_url.query_params_decoded) == 1
                      and all(flatten(values(.href_url.query_params_decoded)),
                              . == ''
                      )
                    )
                    or (
                      ml.link_analysis(.).effective_url.path == '/'
                      and regex.imatch(ml.link_analysis(.).effective_url.query_params,
                                       '[A-Za-z0-9+/]{8}'
                      )
                      and length(ml.link_analysis(.).effective_url.query_params_decoded
                      ) == 1
                      and all(flatten(values(ml.link_analysis(.).effective_url.query_params_decoded
                                      )
                              ),
                              . == ''
                      )
                    )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)