Detection rules › Sublime MQL
Attachment: Calendar invite from recently registered domain
Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Evasion, ICS Phishing, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) > 0
and all(attachments, .content_type in ("text/calendar", "application/ics"))
and any(attachments,
any(file.explode(.),
any(.scan.ics.calendars,
any(.components,
any(.organizers,
network.whois(.mailbox.email.domain).days_old < 90
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.
- inbound message
- length(attachments) > 0
all of
attachmentswhere:- .content_type in ('text/calendar', 'application/ics')
any of
attachmentswhere:any of
file.explode(.)where:any of
.scan.ics.calendarswhere:any of
.componentswhere:any of
.organizerswhere:- network.whois(.mailbox.email.domain).days_old < 90
Inspects: attachments[].content_type, type.inbound. Sensors: file.explode, network.whois.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | member | text/calendar |
attachments[].content_type | member | application/ics |