Attachment: ICS file with embedded email

calendar Nov 5, 2026  ·
Share on: linkedin copy

Detects inbound messages containing ICS calendar attachments where a parsed event includes an embedded RFC822 email as a base64-encoded attachment rather than a simple URL reference. This technique smuggles a nested email payload inside a calendar invite, often to evade attachment scanning or deliver malicious content indirectly.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS file with embedded email"
 2description: "Detects inbound messages containing ICS calendar attachments where a parsed event includes an embedded RFC822 email as a base64-encoded attachment rather than a simple URL reference. This technique smuggles a nested email payload inside a calendar invite, often to evade attachment scanning or deliver malicious content indirectly."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  // .md5 proves the payload is embedded base64, not a Gmail ?view=att URL reference
19                  any(.attachments, .md5 is not null)
20                  and (
21                    any(.attachments, .file_extension == "eml")
22                    or any(.raw_properties,
23                           .name == "ATTACH"
24                           and any(.params,
25                                   .name == "FMTTYPE"
26                                   and "message/rfc822" in .values
27                           )
28                    )
29                  )
30          )
31  )  
32attack_types:
33  - "Malware/Ransomware"
34  - "Credential Phishing"
35tactics_and_techniques:
36  - "ICS Phishing"
37  - "Evasion"
38detection_methods:
39  - "File analysis"
40id: "31122212-d9a8-5190-85b2-46ff7e0a1212"
to-top