Medium Severity

Attachment: ICS calendar invite with hex-encoded recipient in link

Labels

Credential Phishing

Evasion

Description

Flags inbound messages carrying an ICS calendar attachment whose event data contains a link where the URL fragment is hex-encoded to match the recipient's own email address. This encoding technique is used to personalize and track malicious links delivered through calendar invites, distinguishing this detection from rules covering links in the message body or non-ICS attachments.

References

No references.

Sublime Security

Created Sep 16th, 2026 • Last updated Sep 28th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(.links,
                    strings.decode_hex(.href_url.fragment) == recipients.to[0].email.email
                )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.