Medium Severity

Attachment: ICS calendar invite with BEC intent

Description

Detects inbound messages containing the phrase '(Guest list is too large to display)' in the body alongside an ICS calendar attachment. The rule parses the ICS file and applies an NLU classifier to the event summary and description fields to identify business email compromise (BEC) intent. Messages from high-trust root domains that pass DMARC authentication are excluded from this detection.

References

No references.

Sublime Security
Created Sep 22nd, 2026 • Last updated Sep 28th, 2026
Source
type.inbound
and strings.contains(body.current_thread.text,
                     '(Guest list is too large to display)',
                     '(Gästeliste zu groß zum Anzeigen)',
                     '(La liste des invités est trop longue pour être affichée)',
                     '(La liste des invités est trop importante pour être affichée)',
                     '(Список гостей слишком велик, невозможно отобразить его полностью)',
                     '(Elenco invitati troppo lungo per la visualizzazione)',
                     '(A lista de convidados é muito grande para ser exibida)',
                     '(Gæstelisten er for lang til at blive vist)'
)
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                // bec intent on summary or description
                any([.summary, .description],
                    any(ml.nlu_classifier(.).intents,
                        .name == 'bec' and .confidence != 'low'
                    )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started