Detection rules › Sublime MQL
Attachment: ICS file with meeting prefix
Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | ICS Phishing, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) == 1
and any(filter(attachments,
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
),
regex.icontains(.file_name, 'meeting_[a-zA-Z0-9]{5}\.')
)
Detection logic
Scope: inbound message.
Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.
- inbound message
- length(attachments) is 1
any of
filter(attachments)where:- .file_name matches 'meeting_[a-zA-Z0-9]{5}\\.'
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: regex.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |
regex.icontains | regex | meeting_[a-zA-Z0-9]{5}\. |