Detection rules › Sublime MQL
Attachment: ICS calendar file with recipient address in UID field
Detects inbound messages containing ICS calendar attachments where the UID property matches the recipient's email address, indicating potential calendar-based social engineering.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_type == "ics"
or (
.file_extension == "ics"
or .content_type in ("application/ics", "text/calendar")
)
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(beta.file.parse_ics(.).events,
any(.raw_properties,
.key == "UID" and .value == recipients.to[0].email.email
)
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing ICS calendar attachments where the UID property matches the recipient's email address, indicating potential calendar-based social engineering.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_type is 'ics'
any of:
- .file_extension is 'ics'
- .content_type in ('application/ics', 'text/calendar')
any of
beta.file.parse_ics(.).eventswhere:any of
.raw_propertieswhere all hold:- .key is 'UID'
- .value is recipients.to[0].email.email
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, recipients.to[0].email.email, type.inbound. Sensors: beta.file.parse_ics.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | ics |
attachments[].file_extension | equals | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |
beta.file.parse_ics(attachments[]).events[].raw_properties[].key | equals | UID |