Detection rules › Sublime MQL
Attachment: ICS with employee policy review lure
Detects ICS calendar attachments containing references to 'policy review' and 'secure access' terminology, which may be used in social engineering attacks to prompt users to take action under the guise of compliance or security requirements.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Evasion, ICS Phishing, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments,
.file_type in~ ('ics')
or .content_type in ("text/calendar", "application/ics")
),
any(file.explode(.),
.depth == 0
and any(.scan.strings.strings,
strings.icontains(., 'policy review')
)
and any(.scan.strings.strings,
strings.icontains(., 'secure access')
)
)
)
Detection logic
Scope: inbound message.
Detects ICS calendar attachments containing references to 'policy review' and 'secure access' terminology, which may be used in social engineering attacks to prompt users to take action under the guise of compliance or security requirements.
- inbound message
any of
filter(attachments)where:any of
file.explode(.)where all hold:- .depth is 0
any of
.scan.strings.stringswhere:- . contains 'policy review'
any of
.scan.strings.stringswhere:- . contains 'secure access'
Inspects: attachments[].content_type, attachments[].file_type, type.inbound. Sensors: file.explode, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | member | ics |
attachments[].content_type | member | text/calendar |
attachments[].content_type | member | application/ics |
strings.icontains | substring | policy review |
strings.icontains | substring | secure access |