sublimemediumRule

Attachment: ICS file with credential theft indicators

Detects inbound emails containing calendar invite (.ics) attachments where the parsed event description is classified by NLU as having high-confidence credential theft intent and financial communication topics, and where embedded links point to domains that differ from the sender's domain and match known free file hosts, free subdomain hosts, self-service creation platforms, URL shorteners, suspicious TLDs, or newly registered domains (less than 90 days old).

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(ml.nlu_classifier(.description).intents,
                    .name == "cred_theft" and .confidence == "high"
                )
                and any(ml.nlu_classifier(.description).topics,
                        .name == "Financial Communications"
                        and .confidence != "low"
                )
                and any(.links,
                        .href_url.domain.root_domain != sender.email.domain.root_domain
                        and (
                          .href_url.domain.root_domain in $self_service_creation_platform_domains
                          or .href_url.domain.domain in $self_service_creation_platform_domains
                          or .href_url.domain.root_domain in $free_file_hosts
                          or .href_url.domain.domain in $free_file_hosts
                          or .href_url.domain.root_domain in $free_subdomain_hosts
                          or .href_url.domain.domain in $free_subdomain_hosts
                          or .href_url.domain.tld in $suspicious_tlds
                          or .href_url.domain.domain in $url_shorteners
                          or .href_url.domain.root_domain in $url_shorteners
                          or network.whois(.href_url.domain).days_old < 90
                        )
                )
        )
)
and not (
  strings.istarts_with(subject.base,
                       "accepted:",
                       "declined:",
                       "_accepted:",
                       "_declined:"
  )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: ICS file with credential theft indicators"
description: "Detects inbound emails containing calendar invite (.ics) attachments where the parsed event description is classified by NLU as having high-confidence credential theft intent and financial communication topics, and where embedded links point to domains that differ from the sender's domain and match known free file hosts, free subdomain hosts, self-service creation platforms, URL shorteners, suspicious TLDs, or newly registered domains (less than 90 days old)."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.file.parse_ics(.).events,
                  any(ml.nlu_classifier(.description).intents,
                      .name == "cred_theft" and .confidence == "high"
                  )
                  and any(ml.nlu_classifier(.description).topics,
                          .name == "Financial Communications"
                          and .confidence != "low"
                  )
                  and any(.links,
                          .href_url.domain.root_domain != sender.email.domain.root_domain
                          and (
                            .href_url.domain.root_domain in $self_service_creation_platform_domains
                            or .href_url.domain.domain in $self_service_creation_platform_domains
                            or .href_url.domain.root_domain in $free_file_hosts
                            or .href_url.domain.domain in $free_file_hosts
                            or .href_url.domain.root_domain in $free_subdomain_hosts
                            or .href_url.domain.domain in $free_subdomain_hosts
                            or .href_url.domain.tld in $suspicious_tlds
                            or .href_url.domain.domain in $url_shorteners
                            or .href_url.domain.root_domain in $url_shorteners
                            or network.whois(.href_url.domain).days_old < 90
                          )
                  )
          )
  )
  and not (
    strings.istarts_with(subject.base,
                         "accepted:",
                         "declined:",
                         "_accepted:",
                         "_declined:"
    )
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Free subdomain host"
  - "Social engineering"
  - "ICS Phishing"
detection_methods:
  - "File analysis"
  - "Natural Language Understanding"
  - "URL analysis"
  - "Whois"
id: "1bfa7d80-ff4c-5b82-9f3b-a58b157fb41a"