Sublime Security medium experimental mql

Non-RFC compliant calendar files from unsolicited sender

Detects calendar (.ics) files that do not follow RFC standards by lacking required UID identifiers while containing specific calendar components (VTODO, VJOURNAL, VFREEBUSY, or VEVENT). Forged ICS calendar invites can be spoofed to seemingly originate from any sender.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in $file_extensions_common_archives
          or .file_extension == "ics"
          or .content_type == "text/calendar"
        )
        and any(file.explode(.),
                (.file_extension == "ics" or .flavors.mime == "text/calendar")
                and any(.scan.ics.calendars,
                        any(.components,
                            .uid is null
                            and .type in (
                              'VEVENT',
                              'VJOURNAL',
                              'VFREEBUSY',
                              'VTODO'
                            )
                        )
                )
        )
)
and not profile.by_sender_email().any_messages_benign

Field Validations

Loading…

Comments (0)

Loading comments...