Sublime Security high experimental mql

Attachment: ICS with employee policy review lure

Detects ICS calendar attachments containing references to 'policy review' and 'secure access' terminology, which may be used in social engineering attacks to prompt users to take action under the guise of compliance or security requirements.

View Source

Detection Logic

type.inbound
and any(filter(attachments,
               .file_type in~ ('ics')
               or .content_type in ("text/calendar", "application/ics")
        ),
        any(file.explode(.),
            .depth == 0
            and any(.scan.strings.strings,
                    strings.icontains(., 'policy review')
            )
            and any(.scan.strings.strings,
                    strings.icontains(., 'secure access')
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...