Attachment: ICS calendar invite with BEC intent

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects inbound messages containing the phrase '(Guest list is too large to display)' in the body alongside an ICS calendar attachment. The rule parses the ICS file and applies an NLU classifier to the event summary and description fields to identify business email compromise (BEC) intent. Messages from high-trust root domains that pass DMARC authentication are excluded from this detection.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar invite with BEC intent"
 2description: "Detects inbound messages containing the phrase '(Guest list is too large to display)' in the body alongside an ICS calendar attachment. The rule parses the ICS file and applies an NLU classifier to the event summary and description fields to identify business email compromise (BEC) intent. Messages from high-trust root domains that pass DMARC authentication are excluded from this detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6   type.inbound
 7   and strings.contains(body.current_thread.text,
 8                        '(Guest list is too large to display)',
 9                        '(Gästeliste zu groß zum Anzeigen)'
10   )
11   and any(attachments,
12           (
13             .file_type == "ics"
14             or .file_extension == "ics"
15             or .content_type in ("application/ics", "text/calendar")
16           )
17           // This rule makes use of a beta feature and is subject to change without notice
18           // using the beta feature in custom rules is not suggested until it has been formally released
19           //
20           and any(beta.file.parse_ics(.).events,
21                   // bec intent on summary or description
22                   any([.summary, .description],
23                       any(ml.nlu_classifier(.).intents,
24                           .name == 'bec' and .confidence != 'low'
25                       )
26                   )
27           )
28   )
29   and not (
30     sender.email.domain.root_domain in $high_trust_sender_root_domains
31     and coalesce(headers.auth_summary.dmarc.pass, false)
32   )   
33attack_types:
34  - "BEC/Fraud"
35tactics_and_techniques:
36  - "Social engineering"
37detection_methods:
38  - "Content analysis"
39  - "Natural Language Understanding"
40  - "File analysis"
41  - "Header analysis"
42id: "b9f819b8-3498-5322-b9cd-f411475e38b5"
to-top