Detection rules › Sublime MQL

Attachment: ICS file with meeting prefix

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesICS Phishing, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(attachments) == 1
and any(filter(attachments,
               .file_extension in~ ('ics')
               or .content_type in ("application/ics", "text/calendar")
        ),
        regex.icontains(.file_name, 'meeting_[a-zA-Z0-9]{5}\.')
)

Detection logic

Scope: inbound message.

Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.

  1. inbound message
  2. length(attachments) is 1
  3. any of filter(attachments) where:
    • .file_name matches 'meeting_[a-zA-Z0-9]{5}\\.'

Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: regex.icontains.

Indicators matched (4)

FieldMatchValue
attachments[].file_extensionmemberics
attachments[].content_typememberapplication/ics
attachments[].content_typemembertext/calendar
regex.icontainsregexmeeting_[a-zA-Z0-9]{5}\.