sublimemediumRule

Attachment: Oversized guest-list calendar invite with purchase order lure

Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598 T1598.003

initial-access

Detection Query

type.inbound
and strings.contains(body.current_thread.text,
                     '(Guest list is too large to display)',
                     '(Gästeliste zu groß zum Anzeigen)',
                     '(La liste des invités est trop longue pour être affichée)',
                     '(La liste des invités est trop importante pour être affichée)',
                     '(Список гостей слишком велик, невозможно отобразить его полностью)',
                     '(Elenco invitati troppo lungo per la visualizzazione)',
                     '(A lista de convidados é muito grande para ser exibida)',
                     '(Gæstelisten er for lang til at blive vist)'
)
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                // purchase order key words
                any([.summary, .description],
                    any(ml.nlu_classifier(.).topics,
                        .name == 'Purchase Orders' and .confidence != 'low'
                    )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Oversized guest-list calendar invite with purchase order lure"
description: "Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.contains(body.current_thread.text,
                       '(Guest list is too large to display)',
                       '(Gästeliste zu groß zum Anzeigen)',
                       '(La liste des invités est trop longue pour être affichée)',
                       '(La liste des invités est trop importante pour être affichée)',
                       '(Список гостей слишком велик, невозможно отобразить его полностью)',
                       '(Elenco invitati troppo lungo per la visualizzazione)',
                       '(A lista de convidados é muito grande para ser exibida)',
                       '(Gæstelisten er for lang til at blive vist)'
  )
  and any(attachments,
          (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.file.parse_ics(.).events,
                  // purchase order key words
                  any([.summary, .description],
                      any(ml.nlu_classifier(.).topics,
                          .name == 'Purchase Orders' and .confidence != 'low'
                      )
                  )
          )
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
  - "ICS Phishing"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "Header analysis"
id: "78f55688-b8f6-5587-81c5-db166e910eae"