Detection rules › Sublime MQL

Attachment: ICS file with non-Gregorian calendar scale

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, ICS Phishing

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and not strings.icontains(beta.file.parse_ics(.).scale, 'GREGORIAN')
)

Detection logic

Scope: inbound message.

Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in ('ics')
      • .content_type in ('application/ics', 'text/calendar')
    • not:
      • beta.file.parse_ics(.).scale contains 'GREGORIAN'

Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: beta.file.parse_ics, strings.icontains.

Indicators matched (4)

FieldMatchValue
attachments[].file_extensionmemberics
attachments[].content_typememberapplication/ics
attachments[].content_typemembertext/calendar
strings.icontainssubstringGREGORIAN