Sublime Security medium experimental mql

Attachment: ICS calendar file with suspicious product identifier

Detects inbound messages containing ICS calendar attachments that have product identifiers matching patterns commonly associated with malicious calendar invitations. The rule identifies ICS files through multiple detection methods and analyzes the product_id field for suspicious formatting that may indicate automated generation or spoofing attempts.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and (
          regex.icontains(beta.file.parse_ics(.).product_id,
                          '-//[a-z0-9]*[0-9][a-z0-9]*//EN'
          )
          or strings.icontains(beta.file.parse_ics(.).product_id,
                               "-//MyApp//example.com//",
                               "-//My App//NS9 Calendar//EN",
                               "-//SharePoint//NONSGML v1.0//EN",
                               "-//YourCassavaLtd//EateriesDept//EN",
                               "-//Your App//EN",
                               "-//Organization//EN",
                               "-//Calendar Auto//EN",
                               "-Meeting Schedule",
                               "-//JANSANI//Email Engine v12.7//EN",
                               "-Event Mandate",
                               "-//CalendarInviteBuilder//EN",
                               "-//CustomMailer//EN",
                               "Trafft",
                               "-//caldav.icloud.com//CALDAVJ 2620B879//EN",
                               "-//Calendar Event//EN",
                               "-//dilmar//EN",
                               "-//First Dips//Portal//EN",
                               "-//X7fG3//Y2kL9//M9nP4 16.0 MIMEDIR//EN",
                               "-//HRNotify//CompChange 1.0//EN",
                               "-//Prof Morales Sender//EN",
                               "//NONSGML Event//EN"
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...