Attachment: ICS Link With Valueless Base64 Query Parameter

calendar Sep 4, 2026  ·
Share on: linkedin copy

Detects inbound emails containing ICS calendar attachments where embedded event links include a randomized 8-character base64 query parameter with no assigned value. The rule excludes messages from high-trust sender domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS Link With Valueless Base64 Query Parameter"
 2description: "Detects inbound emails containing ICS calendar attachments where embedded event links include a randomized 8-character base64 query parameter with no assigned value. The rule excludes messages from high-trust sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  any(.links,
19                      (
20                        .href_url.path == '/'
21                        and regex.imatch(.href_url.query_params,
22                                         '[A-Za-z0-9+/]{8}'
23                        )
24                        and length(.href_url.query_params_decoded) == 1
25                        and all(flatten(values(.href_url.query_params_decoded)),
26                                . == ''
27                        )
28                      )
29                      or (
30                        ml.link_analysis(.).effective_url.path == '/'
31                        and regex.imatch(ml.link_analysis(.).effective_url.query_params,
32                                         '[A-Za-z0-9+/]{8}'
33                        )
34                        and length(ml.link_analysis(.).effective_url.query_params_decoded
35                        ) == 1
36                        and all(flatten(values(ml.link_analysis(.).effective_url.query_params_decoded
37                                        )
38                                ),
39                                . == ''
40                        )
41                      )
42                  )
43          )
44  )
45  and not (
46    sender.email.domain.root_domain in $high_trust_sender_root_domains
47    and coalesce(headers.auth_summary.dmarc.pass, false)
48  )  
49attack_types:
50  - "ICS Phishing"
51  - "Credential Phishing"
52tactics_and_techniques:
53  - "Evasion"
54  - "Social engineering"
55detection_methods:
56  - "File analysis"
57  - "URL analysis"
58  - "Header analysis"
59id: "d5ce3bc3-9771-541c-a5e5-aedf94cc9e8f"
to-top