Attachment: ICS invite meeting lure

calendar Aug 27, 2026  ·
Share on: linkedin copy

Detects inbound messages carrying an .ics calendar attachment that impersonate meeting invites, referencing dial-in details such as PIN resets, local numbers, or conference IDs. These messages include a tracked link redirecting through the sender's own domain (e.g. /ls/click) and use generic, template-style subject lines like 'Management Progress Meeting' or 'Project Closeout Report', often appended with a machine-generated timestamp. The sending domains are typically unrelated or compromised businesses rather than legitimate meeting platforms, and the pattern is consistent with a phishing kit automating fake meeting invitations to harvest clicks or credentials.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS invite meeting lure"
 2description: "Detects inbound messages carrying an .ics calendar attachment that impersonate meeting invites, referencing dial-in details such as PIN resets, local numbers, or conference IDs. These messages include a tracked link redirecting through the sender's own domain (e.g. /ls/click) and use generic, template-style subject lines like 'Management Progress Meeting' or 'Project Closeout Report', often appended with a machine-generated timestamp. The sending domains are typically unrelated or compromised businesses rather than legitimate meeting platforms, and the pattern is consistent with a phishing kit automating fake meeting invitations to harvest clicks or credentials."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13  )
14  and 2 of (
15    strings.icontains(body.current_thread.text, 'join the meeting now'),
16    strings.icontains(body.current_thread.text, 'reset dial-in pin'),
17    strings.icontains(body.current_thread.text, 'find a local number'),
18    strings.icontains(body.current_thread.text, 'phone conference id')
19  )
20  and any(body.current_thread.links,
21          .href_url.domain.root_domain == sender.email.domain.root_domain
22          and strings.istarts_with(.href_url.path, "/ls/click")
23  )
24  and 2 of (
25    strings.icontains(subject.subject, 'project implementing agreement kick-off'),
26    strings.icontains(subject.subject, 'management progress meeting'),
27    strings.icontains(subject.subject, 'finance committee meeting'),
28    strings.icontains(subject.subject, 'project closeout report'),
29    strings.icontains(subject.subject, '(and new time)'),
30    // kit personalizes with the target org name: "Discussion w/ <Company>:"
31    (
32      regex.icontains(subject.subject, 'discussion w/ .{1,40}:')
33      or 
34      // machine-appended timestamp
35      regex.icontains(subject.subject,
36                      '(?:\d{1,2}:\d{2}:\d{2}|\d{1,2}:\d{2}\s*(?:am|pm))\s*$'
37      )
38    )
39  )  
40attack_types:
41  - "ICS Phishing"
42  - "Credential Phishing"
43tactics_and_techniques:
44  - "Social engineering"
45  - "Impersonation: Brand"
46  - "Spoofing"
47  - "Open redirect"
48detection_methods:
49  - "Content analysis"
50  - "URL analysis"
51  - "Header analysis"
52  - "Sender analysis"
53  - "File analysis"
54id: "1173b7a9-de2e-567a-ab5a-0765710017f6"
to-top