Attachment: ICS calendar invite hiding credential theft

calendar Sep 25, 2026  ·
Share on: linkedin copy

Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite hiding credential theft"
 2description: "Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)'
10  )
11  and any(attachments,
12          (
13            .file_type == "ics"
14            or .file_extension == "ics"
15            or .content_type in ("application/ics", "text/calendar")
16          )
17          // This rule makes use of a beta feature and is subject to change without notice
18          // using the beta feature in custom rules is not suggested until it has been formally released
19          //
20          and any(beta.file.parse_ics(.).events,
21                  // cred theft intent on summary or description
22                  any([.summary, .description],
23                      any(ml.nlu_classifier(.).intents,
24                          .name == 'cred_theft' and .confidence != 'low'
25                      )
26                  )
27          )
28  )
29  and not (
30    sender.email.domain.root_domain in $high_trust_sender_root_domains
31    and coalesce(headers.auth_summary.dmarc.pass, false)
32  )  
33attack_types:
34  - "Credential Phishing"
35  - "ICS Phishing"
36tactics_and_techniques:
37  - "Social engineering"
38  - "Evasion"
39detection_methods:
40  - "File analysis"
41  - "Content analysis"
42  - "Natural Language Understanding"
43  - "Header analysis"
44  - "Sender analysis"
45id: "f56407e0-6f7e-5809-970a-7b04a6b24429"
to-top