Attachment: Oversized guest-list calendar invite with voicemail lure

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches voicemail call or missed call notifications, a common pretext used to lure recipients.

Sublime rule (View on GitHub)

 1name: "Attachment: Oversized guest-list calendar invite with voicemail lure"
 2description: "Detects inbound messages containing calendar (.ics) attachments that exploit Google Calendar's 'Guest list is too large to display' behavior to mass-invite large numbers of unrelated recipients, hiding the true scope of the send. The attached ICS event content is run through NLU topic classification and matches voicemail call or missed call notifications, a common pretext used to lure recipients."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)'
10  )
11  and any(attachments,
12          (
13            .file_type == "ics"
14            or .file_extension == "ics"
15            or .content_type in ("application/ics", "text/calendar")
16          )
17          //
18          // This rule makes use of a beta feature and is subject to change without notice
19          // using the beta feature in custom rules is not suggested until it has been formally released
20          //
21          and any(beta.file.parse_ics(.).events,
22                  // voicemail key words
23                  any([.summary, .description],
24                      any(ml.nlu_classifier(.).topics,
25                          .name == 'Voicemail Call and Missed Call Notifications'
26                          and .confidence != 'low'
27                      )
28                  )
29          )
30  )
31  and not (
32    sender.email.domain.root_domain in $high_trust_sender_root_domains
33    and coalesce(headers.auth_summary.dmarc.pass, false)
34  )  
35attack_types:
36  - "ICS Phishing"
37  - "BEC/Fraud"
38tactics_and_techniques:
39  - "Social engineering"
40  - "Impersonation: Brand"
41detection_methods:
42  - "File analysis"
43  - "Content analysis"
44  - "Natural Language Understanding"
45  - "Sender analysis"
46  - "Header analysis"
47id: "b2bb7bed-1aed-50d3-8969-c62b7f472e9c"
to-top