EXPLORE DETECTIONS
Attachment: ICS calendar file with base64 encoded recipient address in URL parameters
Detects inbound messages containing ICS calendar attachments where event links have multiple URL parameters, and the base64 decoded combination of those parameters matches the recipient's email address. This technique may be used to personalize malicious links or track specific targets.
Attachment: ICS calendar file with legal language
Detects calendar files (.ics files) whose parsed event details reference legal or court-related themes such as settlements, subpoenas, litigation documents, or formal demands.
Attachment: ICS calendar file with QR code containing recipient email address
Detects calendar attachments (.ics files) containing QR codes that include the recipient's email address in the URL, URL fragment, or base64-encoded data. This technique is commonly used to personalize credential theft attacks by embedding the target's email address within calendar invitations.
Attachment: ICS calendar file with real estate fraud link
Detects calendar files (.ics files) whose parsed event content references real estate transaction documents such as closing disclosures, settlement statements, or 1099-S forms.
Attachment: ICS calendar file with recipient address in UID field
Detects inbound messages containing ICS calendar attachments where the UID property matches the recipient's email address, indicating potential calendar-based social engineering.
Attachment: ICS calendar file with suspicious product identifier
Detects inbound messages containing ICS calendar attachments that have product identifiers matching patterns commonly associated with malicious calendar invitations. The rule identifies ICS files through multiple detection methods and analyzes the product_id field for suspicious formatting that may indicate automated generation or spoofing attempts.
Attachment: ICS calendar file with suspicious UID domain
Detects inbound messages containing ICS calendar attachments whose event UID ends with a known-malicious domain (@example.com) or contains a known bulk-invite automation toolkit identifier (mr-calendar-automation). Because the UID is client-supplied and passed through unmodified by calendar providers, it exposes attacker tooling even on invites relayed by legitimate, authenticated infrastructure.
Attachment: ICS calendar invite hiding credential theft
Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded.
Attachment: ICS calendar invite with BEC intent
Detects inbound messages containing the phrase '(Guest list is too large to display)' in the body alongside an ICS calendar attachment. The rule parses the ICS file and applies an NLU classifier to the event summary and description fields to identify business email compromise (BEC) intent. Messages from high-trust root domains that pass DMARC authentication are excluded from this detection.
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
Detects inbound messages containing an ICS calendar attachment whose embedded event description contains bid, RFP, or proposal-related language commonly used in procurement fraud lures. The rule parses the ICS file contents and flags cases where the event also includes a link pointing to a domain that differs from the sender's domain and matches indicators of risk, such as self-service site builders, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains.
Attachment: ICS calendar invite with financial lure and suspicious link
Detects inbound emails containing ICS calendar attachments whose event descriptions reference credit notes, billing adjustments, or invoice reconciliation language, combined with body links pointing to URL shorteners, suspicious TLDs, newly registered domains, free file hosts, or self-service platforms that do not match the sender's domain. Excludes messages from high-trust sender domains that pass DMARC authentication.
Attachment: ICS calendar invite with Google share.google URL shortener in google.<tld>/share.google path form
Detects inbound messages with ICS calendar invites containing links in the form google.<tld>/share.google?q=<code>, which inherits google.<tld> domain reputation to mask an attacker-controlled destination. This google.<tld>/share.google?q= path form is undocumented: Google publishes the share.google shortener feature, but not this on-Google-domain form or its 'q' parameter.
Attachment: ICS calendar invite with hex-encoded recipient in link
Flags inbound messages carrying an ICS calendar attachment whose event data contains a link where the URL fragment is hex-encoded to match the recipient's own email address. This encoding technique is used to personalize and track malicious links delivered through calendar invites, distinguishing this detection from rules covering links in the message body or non-ICS attachments.
Attachment: ICS calendar invite with photo/file share lure
Detects calendar invites sent as .ics attachments from free email providers (Outlook, Hotmail, etc.) that mimic a 'shared a photo/file with you' notification. The rule parses the ICS payload to inspect the actual event description rendered by calendar clients, rather than the email body, looking for file-sharing language flagged by NLU classification or regex matching. It further confirms suspicious intent by checking for an outlook.com 'groups' self-invite organizer or links that route through Google redirectors instead of legitimate Google Drive domains. Highly trusted sender domains are excluded unless they fail DMARC authentication.
Attachment: ICS calendar with embedded file from internal sender with SPF failure
Detects calendar invitations (ICS files) from internal domains that fail SPF authentication and contain embedded attachments, with single attendee and organizer both from organizational domains.
Attachment: ICS calendar with suspicious link Leading to minimal JS landing page
Detects inbound emails with .ics calendar attachments whose parsed events contain links pointing to free file hosts, self-service creation platforms, suspicious TLDs, URL shorteners, or recently registered domains. The rule further confirms suspicion by identifying minimal JavaScript landing pages that load only a script and favicon, a common pattern for redirecting victims to malicious content while evading detection. Emails from highly trusted, DMARC-passing senders are excluded.
Attachment: ICS file with AWS Lambda URL
Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.
Attachment: ICS file with credential theft indicators
Detects inbound emails containing calendar invite (.ics) attachments where the parsed event description is classified by NLU as having high-confidence credential theft intent and financial communication topics, and where embedded links point to domains that differ from the sender's domain and match known free file hosts, free subdomain hosts, self-service creation platforms, URL shorteners, suspicious TLDs, or newly registered domains (less than 90 days old).
Attachment: ICS file with excessive custom properties
ICS calendar attachment contains an unusually high number of custom X- properties, which may indicate attempts to hide malicious content or exploit calendar parsing vulnerabilities.
Attachment: ICS file with links to newly registered domains
Detects calendar invite attachments (ICS files) containing links to domains registered within the last 30 days, which may indicate malicious calendar invitations designed to redirect users to suspicious websites.
Attachment: ICS file with meeting prefix
Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'.
Attachment: ICS file with non-Gregorian calendar scale
Detects ICS calendar attachments that use a non-standard calendar scale other than GREGORIAN, which may indicate malicious calendar files attempting to exploit calendar parsing vulnerabilities or bypass security filters.
Attachment: ICS invite meeting lure
Detects inbound messages carrying an .ics calendar attachment that impersonate meeting invites, referencing dial-in details such as PIN resets, local numbers, or conference IDs. These messages include a tracked link redirecting through the sender's own domain (e.g. /ls/click) and use generic, template-style subject lines like 'Management Progress Meeting' or 'Project Closeout Report', often appended with a machine-generated timestamp. The sending domains are typically unrelated or compromised businesses rather than legitimate meeting platforms, and the pattern is consistent with a phishing kit automating fake meeting invitations to harvest clicks or credentials.
Attachment: ICS link with valueless base64 query parameter
Detects inbound emails containing ICS calendar attachments where embedded event links include a randomized 8-character base64 query parameter with no assigned value. The rule excludes messages from high-trust sender domains that pass DMARC authentication.