Attachment: ICS calendar invite hiding credential theft

calendar Sep 28, 2026  ·
Share on: linkedin copy

Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite hiding credential theft"
 2description: "Flags inbound messages whose body contains the 'Guest list is too large to display' placeholder text alongside an ICS calendar attachment. The rule parses the ICS file's events and applies an NLU intent classifier to the summary and description fields, triggering when credential theft intent is detected. Messages from senders on the high-trust domain allowlist that also pass DMARC are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)',
10                       '(La liste des invités est trop longue pour être affichée)',
11                       '(La liste des invités est trop importante pour être affichée)',
12                       '(Список гостей слишком велик, невозможно отобразить его полностью)',
13                       '(Elenco invitati troppo lungo per la visualizzazione)',
14                       '(A lista de convidados é muito grande para ser exibida)',
15                       '(Gæstelisten er for lang til at blive vist)'
16  )
17  and any(attachments,
18          (
19            .file_type == "ics"
20            or .file_extension == "ics"
21            or .content_type in ("application/ics", "text/calendar")
22          )
23          // This rule makes use of a beta feature and is subject to change without notice
24          // using the beta feature in custom rules is not suggested until it has been formally released
25          //
26          and any(beta.file.parse_ics(.).events,
27                  // cred theft intent on summary or description
28                  any([.summary, .description],
29                      any(ml.nlu_classifier(.).intents,
30                          .name == 'cred_theft' and .confidence != 'low'
31                      )
32                  )
33          )
34  )
35  and not (
36    sender.email.domain.root_domain in $high_trust_sender_root_domains
37    and coalesce(headers.auth_summary.dmarc.pass, false)
38  )  
39attack_types:
40  - "Credential Phishing"
41tactics_and_techniques:
42  - "Social engineering"
43  - "Evasion"
44  - "ICS Phishing"
45detection_methods:
46  - "File analysis"
47  - "Content analysis"
48  - "Natural Language Understanding"
49  - "Header analysis"
50  - "Sender analysis"
51id: "f56407e0-6f7e-5809-970a-7b04a6b24429"
to-top