Detection rules › Sublime MQL

Attachment: Calendar invite from recently registered domain

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesEvasion, ICS Phishing, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(attachments) > 0
and all(attachments, .content_type in ("text/calendar", "application/ics"))
and any(attachments,
        any(file.explode(.),
            any(.scan.ics.calendars,
                any(.components,
                    any(.organizers,
                        network.whois(.mailbox.email.domain).days_old < 90
                    )
                )
            )
        )
)

Detection logic

Scope: inbound message.

Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.

  1. inbound message
  2. length(attachments) > 0
  3. all of attachments where:
    • .content_type in ('text/calendar', 'application/ics')
  4. any of attachments where:
    • any of file.explode(.) where:
      • any of .scan.ics.calendars where:
        • any of .components where:
          • any of .organizers where:
            • network.whois(.mailbox.email.domain).days_old < 90

Inspects: attachments[].content_type, type.inbound. Sensors: file.explode, network.whois.

Indicators matched (2)

FieldMatchValue
attachments[].content_typemembertext/calendar
attachments[].content_typememberapplication/ics