Attachment: ICS voicemail lure with suspicious link

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(beta.file.parse_ics(.).events,
                // voicemail key words
                any([.summary, .description],
                    regex.icontains(.,
                                    '(?:voice\s*mail|voice\s*message|audio\s*message).{0,20}(?:notification|recording|arriv|receiv|waiting|await|pending|available|unheard|ready|logged|in\s+your|from\s+your\s+inbox)|(?:new|pending|unheard|missed|confidential)\s+(?:voice\s*mail|voice\s*message|audio\s*message)|you\s+(?:have|received)\s+a(?:\s+new\s+voice|.{0,30}voice\s*(?:mail|message))|listen\s+to\s+(?:your\s+)?voice\s*mail|listen\s+(?:to\s+)?(?:the|this|your)\s+message|message\s+to\s+listen|wireless\s*caller|audio\s*file|check\s+(?:your\s+)?voice\s*mail|(?:google\s+)?voice\s*mail\s+(?:google\s+voice|google)|google\s+voice\s*mail|voice\s*(?:mail|message)\s+[0-9]{1,2}:[0-9]{2}|duration:\s*[0-9]{1,2}:[0-9]{2}\s*sec'
                    )
                )
                // sus link
                and any(.links,
                        .href_url.domain.root_domain in $free_file_hosts
                        or .href_url.domain.domain in $free_file_hosts
                        or .href_url.domain.root_domain in $self_service_creation_platform_domains
                        or .href_url.domain.domain in $self_service_creation_platform_domains
                        or .href_url.domain.tld in $suspicious_tlds
                        or .href_url.domain.domain in $url_shorteners
                        or .href_url.domain.root_domain in $url_shorteners
                        or network.whois(.href_url.domain).days_old < 90
                        or strings.icontains(.display_url.url, "voicemail")
                        or strings.icontains(.display_text, "voicemail", "wav")
                        // minimal js landing page
                        or length(filter(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                                         .url == ..href_url.url
                                         or (
                                           strings.starts_with(.url,
                                                               ..href_url.url
                                           )
                                           and regex.icontains(.url,
                                                               '[a-z]{3,}\.[0-9a-f]{20}\.js'
                                           )
                                         )
                                         or .url == strings.concat(..href_url.url,
                                                                   'favicon.png'
                                         )
                                  )
                        ) == 3
                        or any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                                          "//script"
                               ).nodes,
                               regex.icontains(.raw,
                                               'setTimeout[\s\S]{0,100}window\.location\.href[\s\S]{0,100},\s*3000'
                               )
                        )
                        or ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in (
                          'workers.dev'
                        )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)