Detection rules › Sublime MQL
Attachment: ICS file with excessive custom properties
ICS calendar attachment contains an unusually high number of custom X- properties, which may indicate attempts to hide malicious content or exploit calendar parsing vulnerabilities.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, ICS Phishing |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments,
.file_type in~ ('ics')
or .content_type in ("text/calendar", "application/ics")
),
regex.icount(file.parse_text(.).text,
'[\r\n]X-[^\r\n]+\x3b\s?[^\r\n]+:\s*[a-f0-9]{32,}'
) > 10
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
or any(beta.file.parse_ics(.).events,
length(filter(.raw_properties,
strings.istarts_with(.key, 'X-')
and regex.icontains(.value, '^[a-f0-9]{32,}$')
)
) > 10
)
)
Detection logic
Scope: inbound message.
ICS calendar attachment contains an unusually high number of custom X- properties, which may indicate attempts to hide malicious content or exploit calendar parsing vulnerabilities.
- inbound message
any of
filter(attachments)where any holds:- regex.icount(file.parse_text(.).text, '[\\r\\n]X-[^\\r\\n]+\\x3b\\s?[^\\r\\n]+:\\s*[a-f0-9]{32,}') > 10
any of
beta.file.parse_ics(.).eventswhere:- length(filter(.raw_properties, strings.istarts_with(.key, 'X-') and regex.icontains(.value, '^[a-f0-9]{32,}$'))) > 10
Inspects: attachments[].content_type, attachments[].file_type, type.inbound. Sensors: beta.file.parse_ics, file.parse_text, regex.icontains, regex.icount, strings.istarts_with.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | member | ics |
attachments[].content_type | member | text/calendar |
attachments[].content_type | member | application/ics |
regex.icount | regex | [\r\n]X-[^\r\n]+\x3b\s?[^\r\n]+:\s*[a-f0-9]{32,} |
strings.istarts_with | prefix | X- |
regex.icontains | regex | ^[a-f0-9]{32,}$ |