Attachment: Oversized guest-list calendar invite with purchase order lure

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request.

Sublime rule (View on GitHub)

 1name: "Attachment: Oversized guest-list calendar invite with purchase order lure"
 2description: "Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches purchase order or bid invitation language, a common pretext used to lure recipients into engaging with a fraudulent business proposal or bid request."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)'
10  )
11  and any(attachments,
12          (
13            .file_type == "ics"
14            or .file_extension == "ics"
15            or .content_type in ("application/ics", "text/calendar")
16          )
17          //
18          // This rule makes use of a beta feature and is subject to change without notice
19          // using the beta feature in custom rules is not suggested until it has been formally released
20          //
21          and any(beta.file.parse_ics(.).events,
22                  // purchase order key words
23                  any([.summary, .description],
24                      any(ml.nlu_classifier(.).topics,
25                          .name == 'Purchase Orders' and .confidence != 'low'
26                      )
27                  )
28          )
29  )
30  and not (
31    sender.email.domain.root_domain in $high_trust_sender_root_domains
32    and coalesce(headers.auth_summary.dmarc.pass, false)
33  )  
34attack_types:
35  - "ICS Phishing"
36  - "BEC/Fraud"
37tactics_and_techniques:
38  - "Social engineering"
39  - "Impersonation: Brand"
40detection_methods:
41  - "File analysis"
42  - "Content analysis"
43  - "Natural Language Understanding"
44  - "Sender analysis"
45  - "Header analysis"
46id: "78f55688-b8f6-5587-81c5-db166e910eae"
to-top