Description

Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.

References

No references.

Sublime Security
Created Apr 1st, 2026 • Last updated Jul 16th, 2026
Source
type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and (
          regex.icontains(file.parse_text(.).text, 'lambda-url')
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          or any(beta.file.parse_ics(.).events,
                 any(.links,
                     strings.icontains(.href_url.domain.domain, "lambda-url")
                 )
          )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started