Medium Severity

Attachment: ICS calendar file with legal language

Description

Detects calendar files (.ics files) whose parsed event details reference legal or court-related themes such as settlements, subpoenas, litigation documents, or formal demands.

References

No references.

Sublime Security
Created Sep 18th, 2026 • Last updated Sep 28th, 2026
Source
type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                (
                  any([.summary, .description],
                      regex.icontains(.,
                                      '(?:dear|hi|hello).(?:counsel|team),',
                                      'file attached',
                                      '\brefer\b',
                                      '\brespon(?:d|se)\b',
                                      '\breview\b'
                      )
                  )
                  or any(.links, regex.icontains(.display_text, 'view'))
                )
                and any([.summary, .description],
                        regex.icontains(.,
                                        'case resolution material',
                                        'court-related',
                                        'court.(?:subpoena|summons)',
                                        '(?:court case|litigation).(?:document|letter)',
                                        'formal.(?:dispute|mediation|recovery)',
                                        'proposed counteroffer',
                                        'paga settlement',
                                        'settlement.(?:&|and.)?(?:brief|document|finalization|material)',
                                        "view court order"
                        )
                )
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started