Attachment: ICS calendar with suspicious link Leading to minimal JS landing page

calendar Sep 21, 2026  ·
Share on: linkedin copy

Detects inbound emails with .ics calendar attachments whose parsed events contain links pointing to free file hosts, self-service creation platforms, suspicious TLDs, URL shorteners, or recently registered domains. The rule further confirms suspicion by identifying minimal JavaScript landing pages that load only a script and favicon, a common pattern for redirecting victims to malicious content while evading detection. Emails from highly trusted, DMARC-passing senders are excluded.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar with suspicious link Leading to minimal JS landing page"
 2description: "Detects inbound emails with .ics calendar attachments whose parsed events contain links pointing to free file hosts, self-service creation platforms, suspicious TLDs, URL shorteners, or recently registered domains. The rule further confirms suspicion by identifying minimal JavaScript landing pages that load only a script and favicon, a common pattern for redirecting victims to malicious content while evading detection. Emails from highly trusted, DMARC-passing senders are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          and any(beta.file.parse_ics(.).events,
14                  // sus link
15                  any(.links,
16                      (
17                        .href_url.domain.root_domain in $free_file_hosts
18                        or .href_url.domain.domain in $free_file_hosts
19                        or .href_url.domain.root_domain in $self_service_creation_platform_domains
20                        or .href_url.domain.domain in $self_service_creation_platform_domains
21                        or .href_url.domain.tld in $suspicious_tlds
22                        or .href_url.domain.domain in $url_shorteners
23                        or .href_url.domain.root_domain in $url_shorteners
24                        or network.whois(.href_url.domain).days_old < 90
25                      )
26                      // minimal js landing page
27                      and length(filter(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
28                                        .url == ..href_url.url
29                                        or (
30                                          strings.starts_with(.url,
31                                                              ..href_url.url
32                                          )
33                                          and regex.icontains(.url,
34                                                              '[a-z]{3,}\.[0-9a-f]{20}\.js'
35                                          )
36                                        )
37                                        or .url == strings.concat(..href_url.url,
38                                                                  'favicon.png'
39                                        )
40                                 )
41                      ) == 3
42                  )
43          )
44  )
45  and not (
46    sender.email.domain.root_domain in $high_trust_sender_root_domains
47    and coalesce(headers.auth_summary.dmarc.pass, false)
48  )  
49attack_types:
50  - "ICS Phishing"
51  - "Credential Phishing"
52tactics_and_techniques:
53  - "Free file host"
54  - "Free subdomain host"
55  - "Evasion"
56  - "Scripting"
57  - "Social engineering"
58detection_methods:
59  - "File analysis"
60  - "URL analysis"
61  - "Whois"
62  - "Javascript analysis"
63  - "Content analysis"
64id: "506490a6-550c-5d1e-a3ea-e2feb58d5cbf"
to-top