Detection rules › Sublime MQL

Attachment: Calendar invite with Google redirect and invoice request

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects calendar file attachments containing Google redirect URLs in the location field combined with invoice-related language in the message body.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesICS Phishing, Open redirect, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and regex.icontains(file.parse_text(.).text,
                            'LOCATION[^:]*:.{1,300}google\.com/url'
        )
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Request to View Invoice" and .confidence == "high"
)

Detection logic

Scope: inbound message.

Detects calendar file attachments containing Google redirect URLs in the location field combined with invoice-related language in the message body.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in ('ics')
      • .content_type in ('application/ics', 'text/calendar')
    • file.parse_text(.).text matches 'LOCATION[^:]*:.{1,300}google\\.com/url'
  3. any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
    • .name is 'Request to View Invoice'
    • .confidence is 'high'

Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, type.inbound. Sensors: file.parse_text, ml.nlu_classifier, regex.icontains.

Indicators matched (6)

FieldMatchValue
attachments[].file_extensionmemberics
attachments[].content_typememberapplication/ics
attachments[].content_typemembertext/calendar
regex.icontainsregexLOCATION[^:]*:.{1,300}google\.com/url
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsRequest to View Invoice
ml.nlu_classifier(body.current_thread.text).topics[].confidenceequalshigh