Sublime Security high experimental mql

Attachment: Calendar invite from recently registered domain

Detects calendar invites (.ics files) from organizers using domains registered within the last 90 days, which may indicate suspicious or malicious calendar invitations.

View Source

Detection Logic

type.inbound
and length(attachments) > 0
and all(attachments, .content_type in ("text/calendar", "application/ics"))
and any(attachments,
        any(file.explode(.),
            any(.scan.ics.calendars,
                any(.components,
                    any(.organizers,
                        network.whois(.mailbox.email.domain).days_old < 90
                    )
                )
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...