Attachment: ICS calendar invite with hex-encoded recipient in link

 1name: "Attachment: ICS calendar invite with hex-encoded recipient in link"
 2description: "Flags inbound messages carrying an ICS calendar attachment whose event data contains a link where the URL fragment is hex-encoded to match the recipient's own email address. This encoding technique is used to personalize and track malicious links delivered through calendar invites, distinguishing this detection from rules covering links in the message body or non-ICS attachments."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  any(.links,
19                      strings.decode_hex(.href_url.fragment) == recipients.to[0].email.email
20                  )
21          )
22  )  
23tags:
24  - "Attack surface reduction"
25attack_types:
26  - "ICS Phishing"
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Evasion"
30  - "Social engineering"
31detection_methods:
32  - "File analysis"
33  - "URL analysis"
34id: "5eec6885-f7f3-5793-8109-e284e7080833"