detection.wiki

Detection rules › Sublime MQL

Attachment: Calendar file with invisible Unicode characters

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects calendar (.ics) attachments containing suspicious invisible Unicode characters, which may be used to hide malicious content or bypass security filters. The rule triggers on messages with calendar-related keywords in the subject or body.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, ICS Phishing

Event coverage

Message attribute
attachments (collection)
body.current_thread
subject
type

Rule body MQL

type.inbound
and not subject.is_reply
and any(attachments, .file_extension in~ ('ics'))
and any(attachments,
        any(file.explode(.),
            .file_extension in~ ('ics')
            and regex.icontains(.scan.strings.raw,
                                '[\x{E0000}-\x{E007F}\x{E0100}-\x{E01EF}\x{2062}\x{2064}]{8,}'
            )
        )
)
and (
  regex.icontains(subject.subject, '(calendar|meeting|event|appointment)')
  or regex.icontains(body.current_thread.text,
                     '(calendar|meeting|event|appointment)'
  )
  or any(attachments, .content_type in~ ("text/calendar"))
)

Detection logic

Scope: inbound message.

Detects calendar (.ics) attachments containing suspicious invisible Unicode characters, which may be used to hide malicious content or bypass security filters. The rule triggers on messages with calendar-related keywords in the subject or body.

  1. inbound message
  2. not:
    • subject.is_reply
  3. any of attachments where:
    • .file_extension in ('ics')
  4. any of attachments where:
    • any of file.explode(.) where all hold:
      • .file_extension in ('ics')
      • .scan.strings.raw matches '[\\x{E0000}-\\x{E007F}\\x{E0100}-\\x{E01EF}\\x{2062}\\x{2064}]{8,}'
  5. any of:
    • subject.subject matches '(calendar|meeting|event|appointment)'
    • body.current_thread.text matches '(calendar|meeting|event|appointment)'
    • any of attachments where:
      • .content_type in ('text/calendar')

Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, subject.is_reply, subject.subject, type.inbound. Sensors: file.explode, regex.icontains.

Indicators matched (5)

FieldMatchValue
attachments[].file_extensionmemberics
file.explode(attachments[])[].file_extensionmemberics
regex.icontainsregex[\x{E0000}-\x{E007F}\x{E0100}-\x{E01EF}\x{2062}\x{2064}]{8,}
regex.icontainsregex(calendar|meeting|event|appointment)
attachments[].content_typemembertext/calendar