Attachment: Oversized guest-list calendar invite with purchase order lure

calendar Sep 28, 2026  ·
Share on: linkedin copy

Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request.

Sublime rule (View on GitHub)

 1name: "Attachment: Oversized guest-list calendar invite with purchase order lure"
 2description: "Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)',
10                       '(La liste des invités est trop longue pour être affichée)',
11                       '(La liste des invités est trop importante pour être affichée)',
12                       '(Список гостей слишком велик, невозможно отобразить его полностью)',
13                       '(Elenco invitati troppo lungo per la visualizzazione)',
14                       '(A lista de convidados é muito grande para ser exibida)',
15                       '(Gæstelisten er for lang til at blive vist)'
16  )
17  and any(attachments,
18          (
19            .file_type == "ics"
20            or .file_extension == "ics"
21            or .content_type in ("application/ics", "text/calendar")
22          )
23          //
24          // This rule makes use of a beta feature and is subject to change without notice
25          // using the beta feature in custom rules is not suggested until it has been formally released
26          //
27          and any(beta.file.parse_ics(.).events,
28                  // purchase order key words
29                  any([.summary, .description],
30                      any(ml.nlu_classifier(.).topics,
31                          .name == 'Purchase Orders' and .confidence != 'low'
32                      )
33                  )
34          )
35  )
36  and not (
37    sender.email.domain.root_domain in $high_trust_sender_root_domains
38    and coalesce(headers.auth_summary.dmarc.pass, false)
39  )  
40attack_types:
41  - "BEC/Fraud"
42tactics_and_techniques:
43  - "Social engineering"
44  - "Impersonation: Brand"
45  - "ICS Phishing"
46detection_methods:
47  - "File analysis"
48  - "Content analysis"
49  - "Natural Language Understanding"
50  - "Sender analysis"
51  - "Header analysis"
52id: "78f55688-b8f6-5587-81c5-db166e910eae"
to-top