Attachment: ICS file with AWS Lambda URL

calendar Jul 16, 2026  ยท
Share on: linkedin copy

Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS file with AWS Lambda URL"
 2description: "Detects ICS calendar files that contain references to AWS Lambda URLs, which may be used to deliver malicious content or redirect users to suspicious resources."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_extension in~ ('ics')
10            or .content_type in ("application/ics", "text/calendar")
11          )
12          and (
13            regex.icontains(file.parse_text(.).text, 'lambda-url')
14            //
15            // This rule makes use of a beta feature and is subject to change without notice
16            // using the beta feature in custom rules is not suggested until it has been formally released
17            //
18            or any(beta.file.parse_ics(.).events,
19                   any(.links,
20                       strings.icontains(.href_url.domain.domain, "lambda-url")
21                   )
22            )
23          )
24  )  
25
26attack_types:
27  - "Credential Phishing"
28  - "Malware/Ransomware"
29tactics_and_techniques:
30  - "Evasion"
31  - "Free file host"
32  - "ICS Phishing"
33detection_methods:
34  - "Content analysis"
35  - "File analysis"
36  - "URL analysis"
37id: "ecc8c457-f171-5f22-a3c1-dac281d7b3e0"
to-top