Detection rules › Sublime MQL
Attachment: ICS file with AWS Lambda URL
Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, Free file host, ICS Phishing |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
)
and regex.icontains(file.parse_text(.).text, 'lambda-url')
)
Detection logic
Scope: inbound message.
Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('ics')
- .content_type in ('application/ics', 'text/calendar')
- file.parse_text(.).text matches 'lambda-url'
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.parse_text, regex.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |
regex.icontains | regex | lambda-url |