Detection rules › Sublime MQL
Non-RFC compliant calendar files from unsolicited sender
Detects calendar (.ics) files that do not follow RFC standards by lacking required UID identifiers while containing specific calendar components (VTODO, VJOURNAL, VFREEBUSY, or VEVENT). Forged ICS calendar invites can be spoofed to seemingly originate from any sender.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Tactics and techniques | Evasion, ICS Phishing, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in $file_extensions_common_archives
or .file_extension == "ics"
or .content_type == "text/calendar"
)
and any(file.explode(.),
(.file_extension == "ics" or .flavors.mime == "text/calendar")
and any(.scan.ics.calendars,
any(.components,
.uid is null
and .type in (
'VEVENT',
'VJOURNAL',
'VFREEBUSY',
'VTODO'
)
)
)
)
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Detects calendar (.ics) files that do not follow RFC standards by lacking required UID identifiers while containing specific calendar components (VTODO, VJOURNAL, VFREEBUSY, or VEVENT). Forged ICS calendar invites can be spoofed to seemingly originate from any sender.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_common_archives
- .file_extension is 'ics'
- .content_type is 'text/calendar'
any of
file.explode(.)where all hold:any of:
- .file_extension is 'ics'
- .flavors.mime is 'text/calendar'
any of
.scan.ics.calendarswhere:any of
.componentswhere all hold:- .uid is missing
- .type in ('VEVENT', 'VJOURNAL', 'VFREEBUSY', 'VTODO')
not:
- profile.by_sender_email().any_messages_benign
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.explode, profile.by_sender_email. Reference lists: $file_extensions_common_archives.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | ics |
attachments[].content_type | equals | text/calendar |
file.explode(attachments[])[].file_extension | equals | ics |
file.explode(attachments[])[].flavors.mime | equals | text/calendar |
file.explode(attachments[])[].scan.ics.calendars[].components[].type | member | VEVENT |
file.explode(attachments[])[].scan.ics.calendars[].components[].type | member | VJOURNAL |
file.explode(attachments[])[].scan.ics.calendars[].components[].type | member | VFREEBUSY |
file.explode(attachments[])[].scan.ics.calendars[].components[].type | member | VTODO |