sublimemediumRule

Attachment: ICS calendar invite hiding credential theft

Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and strings.contains(body.current_thread.text,
                     '(Guest list is too large to display)',
                     '(Gästeliste zu groß zum Anzeigen)',
                     '(La liste des invités est trop longue pour être affichée)',
                     '(La liste des invités est trop importante pour être affichée)',
                     '(Список гостей слишком велик, невозможно отобразить его полностью)',
                     '(Elenco invitati troppo lungo per la visualizzazione)',
                     '(A lista de convidados é muito grande para ser exibida)',
                     '(Gæstelisten er for lang til at blive vist)'
)
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                // cred theft intent on summary or description
                any([.summary, .description],
                    any(ml.nlu_classifier(.).intents,
                        .name == 'cred_theft' and .confidence != 'low'
                    )
                )
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: ICS calendar invite hiding credential theft"
description: "Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.contains(body.current_thread.text,
                       '(Guest list is too large to display)',
                       '(Gästeliste zu groß zum Anzeigen)',
                       '(La liste des invités est trop longue pour être affichée)',
                       '(La liste des invités est trop importante pour être affichée)',
                       '(Список гостей слишком велик, невозможно отобразить его полностью)',
                       '(Elenco invitati troppo lungo per la visualizzazione)',
                       '(A lista de convidados é muito grande para ser exibida)',
                       '(Gæstelisten er for lang til at blive vist)'
  )
  and any(attachments,
          (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.file.parse_ics(.).events,
                  // cred theft intent on summary or description
                  any([.summary, .description],
                      any(ml.nlu_classifier(.).intents,
                          .name == 'cred_theft' and .confidence != 'low'
                      )
                  )
          )
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
  - "ICS Phishing"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "Natural Language Understanding"
  - "Header analysis"
  - "Sender analysis"
id: "f56407e0-6f7e-5809-970a-7b04a6b24429"