Attachment: ICS with Suspicious Office 365 app authorization (OAuth) link

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(.links,
                    .href_url.domain.domain == 'login.microsoftonline.com'
                    and (
                      strings.ilike(.href_url.query_params,
                                    '*offline_access*',
                                    '*.readwrite*',
                                    '*.read*',
                                    '*ctx=*',
                                    '*prompt=none*'
                      )
                      or (
                        strings.icontains(.href_url.path, '/common/reprocess')
                        and strings.icontains(.href_url.query_params, 'ctx=')
                        and strings.icontains(.href_url.query_params,
                                              'sessionId='
                        )
                      )
                    )
                )
        )
)