Medium Severity

Non-RFC Compliant Calendar Files from unsolicited sender

Labels

Evasion

Social engineering

Description

Detects calendar (.ics) files that do not follow RFC standards by lacking required UID identifiers while containing specific calendar components (VTODO, VJOURNAL, VFREEBUSY, or VEVENT). Forged ICS calendar invites can be spoofed to seemingly originate from any sender.

References

https://mrd0x.com/spoofing-calendar-invites-using-ics-files/

Sublime Security

Created Nov 20th, 2024 • Last updated Nov 20th, 2024

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        (
          .file_extension in $file_extensions_common_archives
          or .file_extension == "ics"
          or .content_type == "text/calendar"
        )
        and any(file.explode(.),
                (.file_extension == "ics" or .flavors.mime == "text/calendar")
                and not any(.scan.strings.strings,
                            strings.starts_with(., "UID:")
                )
                and any(.scan.strings.strings,
                        strings.ilike(.,
                                      "*VTODO*",
                                      "*VJOURNAL*",
                                      "*VFREEBUSY*",
                                      "*VEVENT*"
                        )
                )
        )
)
and not profile.by_sender().solicited

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.