• Sublime Core Feed
Medium Severity

Attachment: ICS file with non-Gregorian calendar scale

Labels

Credential Phishing
Evasion
File analysis
Content analysis

Description

Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.

References

No references.

Sublime Security
Created Nov 4th, 2025 • Last updated Nov 4th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and not strings.icontains(beta.file.parse_ics(.).scale, 'GREGORIAN')
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started