Sublime Security medium experimental mql

Attachment: ICS file with AWS Lambda URL

Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and (
          regex.icontains(file.parse_text(.).text, 'lambda-url')
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          or any(beta.file.parse_ics(.).events,
                 any(.links,
                     strings.icontains(.href_url.domain.domain, "lambda-url")
                 )
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...