sublimemediumRule

Attachment: ICS calendar invite with hex-encoded recipient in link

Flags inbound messages carrying an ICS calendar attachment whose event data contains a link where the URL fragment is hex-encoded to match the recipient's own email address. This encoding technique is used to personalize and track malicious links delivered through calendar invites, distinguishing this detection from rules covering links in the message body or non-ICS attachments.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(.links,
                    strings.decode_hex(.href_url.fragment) == recipients.to[0].email.email
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: ICS calendar invite with hex-encoded recipient in link"
description: "Flags inbound messages carrying an ICS calendar attachment whose event data contains a link where the URL fragment is hex-encoded to match the recipient's own email address. This encoding technique is used to personalize and track malicious links delivered through calendar invites, distinguishing this detection from rules covering links in the message body or non-ICS attachments."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.file.parse_ics(.).events,
                  any(.links,
                      strings.decode_hex(.href_url.fragment) == recipients.to[0].email.email
                  )
          )
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "ICS Phishing"
detection_methods:
  - "File analysis"
  - "URL analysis"
id: "5eec6885-f7f3-5793-8109-e284e7080833"