Detection rules › Sublime MQL
Attachment: ICS file with non-Gregorian calendar scale
Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, ICS Phishing |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
)
and not strings.icontains(beta.file.parse_ics(.).scale, 'GREGORIAN')
)
Detection logic
Scope: inbound message.
Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('ics')
- .content_type in ('application/ics', 'text/calendar')
not:
- beta.file.parse_ics(.).scale contains 'GREGORIAN'
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: beta.file.parse_ics, strings.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |
strings.icontains | substring | GREGORIAN |