Sublime Security medium experimental mql

Attachment: ICS file with non-Gregorian calendar scale

Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and not strings.icontains(beta.file.parse_ics(.).scale, 'GREGORIAN')
)

Field Validations

Loading…

Comments (0)

Loading comments...