Sublime Security medium experimental mql

Attachment: ICS file with links to newly registered domains

Detects calendar invite attachments (ICS files) containing links to domains registered within the last 30 days, which may indicate malicious calendar invitations designed to redirect users to suspicious websites.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or (
            .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(.links, network.whois(.href_url.domain).days_old < 30)
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...