Medium Severity

Attachment: ICS calendar file with suspicious UID domain

Labels

Credential Phishing

BEC/Fraud

Description

Detects inbound messages containing ICS calendar attachments whose event UID ends with a known-malicious domain (@example.com) or contains a known bulk-invite automation toolkit identifier (mr-calendar-automation). Because the UID is client-supplied and passed through unmodified by calendar providers, it exposes attacker tooling even on invites relayed by legitimate, authenticated infrastructure.

References

No references.

Sublime Security

Created Jul 2nd, 2026 • Last updated Sep 29th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                strings.iends_with(.uid,
                                   "@example.com",
                                   "mr-calendar-automation"
                )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.