Attachment: ICS calendar invite with photo/file share lure

calendar Sep 9, 2026  ·
Share on: linkedin copy

Detects calendar invites sent as .ics attachments from free email providers (Outlook, Hotmail, etc.) that mimic a 'shared a photo/file with you' notification. The rule parses the ICS payload to inspect the actual event description rendered by calendar clients, rather than the email body, looking for file-sharing language flagged by NLU classification or regex matching. It further confirms suspicious intent by checking for an outlook.com 'groups' self-invite organizer or links that route through Google redirectors instead of legitimate Google Drive domains. Highly trusted sender domains are excluded unless they fail DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite with photo/file share lure"
 2description: "Detects calendar invites sent as .ics attachments from free email providers (Outlook, Hotmail, etc.) that mimic a 'shared a photo/file with you' notification. The rule parses the ICS payload to inspect the actual event description rendered by calendar clients, rather than the email body, looking for file-sharing language flagged by NLU classification or regex matching. It further confirms suspicious intent by checking for an outlook.com 'groups' self-invite organizer or links that route through Google redirectors instead of legitimate Google Drive domains. Highly trusted sender domains are excluded unless they fail DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain in $free_email_providers
 8  and any(attachments,
 9          (
10            .file_type == "ics"
11            or .file_extension == "ics"
12            or .content_type in ("application/ics", "text/calendar")
13          )
14          //
15          // this rule makes use of a beta feature and is subject to change without notice
16          // parse the ICS and read the payload the calendar client renders, not the
17          // (obfuscatable / image-rendered) html body
18          //
19          and any(beta.file.parse_ics(.).events,
20                  // calendar invite contains file sharing language in the description of the invite
21                  // just-in-case addition of a regex match on stuff like "shared a folder"
22                  (
23                    any(ml.nlu_classifier(.description).topics,
24                        .name == 'File Sharing and Cloud Services'
25                    )
26                    or regex.icontains(.description,
27                                       "shared (?:a|an) (?:folder|photo|album|picture|image|file|doc) with you"
28                    )
29                  )
30                  // outlook "groups" self-invite (organizer is a long-numeric groups.outlook.com mailbox)
31                  // or the "View photo" cta routes through a google redirector (share.google / search.app)
32                  // rather than drive.google.com
33                  and (
34                    .organizer.email.domain.domain == "groups.outlook.com"
35                    or any(.links,
36                           .href_url.domain.tld == "google"
37                           or .href_url.domain.root_domain == "search.app"
38                    )
39                  )
40          )
41  )
42  // negate highly trusted sender domains unless they fail DMARC authentication
43  and not (
44    sender.email.domain.root_domain in $high_trust_sender_root_domains
45    and coalesce(headers.auth_summary.dmarc.pass, false)
46  )  
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Free email provider"
51  - "Social engineering"
52  - "Open redirect"
53  - "Image as content"
54detection_methods:
55  - "File analysis"
56  - "Natural Language Understanding"
57  - "Content analysis"
58  - "URL analysis"
59  - "Sender analysis"
60  - "Header analysis"
61id: "efe0c574-5a46-534e-ac32-eeca22486f62"
to-top