Sublime Security medium experimental mql
Attachment: ICS file with AWS Lambda URL
Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.
Detection Logic
type.inbound
and any(attachments,
(
.file_extension in~ ('ics')
or .content_type in ("application/ics", "text/calendar")
)
and (
regex.icontains(file.parse_text(.).text, 'lambda-url')
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
or any(beta.file.parse_ics(.).events,
any(.links,
strings.icontains(.href_url.domain.domain, "lambda-url")
)
)
)
) Field Validations
Loading…
Comments (0)
Loading comments...