Detection rules › Sublime MQL
Attachment: Calendar invite with Google redirect and invoice request
Detects calendar file attachments containing Google redirect URLs in the location field combined with invoice-related language in the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | ICS Phishing, Open redirect, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
)
and regex.icontains(file.parse_text(.).text,
'LOCATION[^:]*:.{1,300}google\.com/url'
)
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Request to View Invoice" and .confidence == "high"
)
Detection logic
Scope: inbound message.
Detects calendar file attachments containing Google redirect URLs in the location field combined with invoice-related language in the message body.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('ics')
- .content_type in ('application/ics', 'text/calendar')
- file.parse_text(.).text matches 'LOCATION[^:]*:.{1,300}google\\.com/url'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Request to View Invoice'
- .confidence is 'high'
Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, type.inbound. Sensors: file.parse_text, ml.nlu_classifier, regex.icontains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |
regex.icontains | regex | LOCATION[^:]*:.{1,300}google\.com/url |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Request to View Invoice |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |