Sublime Security medium experimental mql

Attachment: ICS calendar invite with bid/RFP lure and suspicious link

Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                regex.icontains(.description,
                                'invite\s+(?:your\s+)?company\s+to\s+participate\s+in\s+(?:the\s+)?bidding\s+process',
                                'pre-bid\s+meeting\s+to\s+present\s+(?:the\s+)?project\s+scope',
                                'access\s+the\s+[0-9]{4}\s+bid\s+documents',
                                'RFI-[0-9]{2}-[0-9]{4}-[0-9]{3}',
                                'bid\s+(?:document
| package)\s*[,–-]\s*RFI',
                                'complete\s+bid\s+package.{0,30}including\s+all\s+relevant\s+documents',
                                'invite.{0,20}(?:company
| organization
| firm
| business).{0,30}(?:participate
| partake).{0,30}(?:bid
| proposal
| RFP
| RFQ
| financial\s+review)',
                                '(?:evaluate
| review
| assess).{0,30}(?:proposals?
| RFPs?
| RFQs?).{0,30}(?:financial
| accounting)',
                                'project\s+specifications?\s+(?:and\s+)?requirements?',
                                'invite.{0,30}participate.{0,50}(?:review
| proposal)'
                )
        )
)
and any(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
        and (
          .href_url.domain.root_domain in $self_service_creation_platform_domains
          or .href_url.domain.domain in $self_service_creation_platform_domains
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $free_subdomain_hosts
          or .href_url.domain.tld in $suspicious_tlds
          or .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or network.whois(.href_url.domain).days_old < 90
          or regex.icontains(.display_text,
                             '(?:review
| view
| open
| access
| download)\W+(?:bid
| proposal
| document
| rfp
| rfq
| tender)'
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...