Attachment: ICS calendar invite with financial lure and suspicious link

calendar Aug 22, 2026  ·
Share on: linkedin copy

Detects inbound emails containing ICS calendar attachments whose event descriptions reference credit notes, billing adjustments, or invoice reconciliation language, combined with body links pointing to URL shorteners, suspicious TLDs, newly registered domains, free file hosts, or self-service platforms that do not match the sender's domain. Excludes messages from high-trust sender domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite with financial lure and suspicious link"
 2description: "Detects inbound emails containing ICS calendar attachments whose event descriptions reference credit notes, billing adjustments, or invoice reconciliation language, combined with body links pointing to URL shorteners, suspicious TLDs, newly registered domains, free file hosts, or self-service platforms that do not match the sender's domain. Excludes messages from high-trust sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  regex.icontains(.description,
19                                  'credit\s+note.{0,30}CN-[0-9]{8}',
20                                  '(?:review|issued?).{0,30}credit\s+note',
21                                  'credit.{0,20}(?:has\s+been\s+)?issued.{0,30}(?:invoice|billing|pricing\s+adjustment)',
22                                  '(?:billing|accounting)\s+(?:review|adjustment|reconciliation).{0,30}credit'
23                  )
24          )
25  )
26  and any(body.links,
27          .href_url.domain.root_domain != sender.email.domain.root_domain
28          and (
29            .href_url.domain.domain in $url_shorteners
30            or .href_url.domain.root_domain in $url_shorteners
31            or .href_url.domain.tld in $suspicious_tlds
32            or network.whois(.href_url.domain).days_old < 90
33            or .href_url.domain.root_domain in $free_file_hosts
34            or .href_url.domain.domain in $free_file_hosts
35            or .href_url.domain.root_domain in $self_service_creation_platform_domains
36            or .href_url.domain.domain in $self_service_creation_platform_domains
37          )
38  )
39  and not (
40    sender.email.domain.root_domain in $high_trust_sender_root_domains
41    and coalesce(headers.auth_summary.dmarc.pass, false)
42  )  
43attack_types:
44  - "Credential Phishing"
45  - "BEC/Fraud"
46tactics_and_techniques:
47  - "Social engineering"
48  - "Evasion"
49detection_methods:
50  - "File analysis"
51  - "Content analysis"
52  - "URL analysis"
53  - "Whois"
54  - "Header analysis"
55id: "30cf1a7f-76d7-518a-bbd7-5308b87a1730"
to-top