Sublime Security high experimental mql

Attachment: ICS file with meeting prefix

Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.

View Source

Detection Logic

type.inbound
and length(attachments) == 1
and any(filter(attachments,
               .file_extension in~ ('ics')
               or .content_type in ("application/ics", "text/calendar")
        ),
        regex.icontains(.file_name, 'meeting_[a-zA-Z0-9]{5}\.')
)

Field Validations

Loading…

Comments (0)

Loading comments...