Attachment: ICS calendar file with suspicious product identifier

calendar Jul 27, 2026  ·
Share on: linkedin copy

Detects inbound messages containing ICS calendar attachments that have product identifiers matching patterns commonly associated with malicious calendar invitations. The rule identifies ICS files through multiple detection methods and analyzes the product_id field for suspicious formatting that may indicate automated generation or spoofing attempts.

Sublime rule (View on GitHub)

 1name: "Attachment: ICS calendar file with suspicious product identifier"
 2description: "Detects inbound messages containing ICS calendar attachments that have product identifiers matching patterns commonly associated with malicious calendar invitations. The rule identifies ICS files through multiple detection methods and analyzes the product_id field for suspicious formatting that may indicate automated generation or spoofing attempts."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and (
18            regex.icontains(beta.file.parse_ics(.).product_id,
19                            '-//[a-z0-9]*[0-9][a-z0-9]*//EN'
20            )
21            or strings.icontains(beta.file.parse_ics(.).product_id,
22                                 "-//MyApp//example.com//",
23                                 "-//My App//NS9 Calendar//EN",
24                                 "-//SharePoint//NONSGML v1.0//EN",
25                                 "-//YourCassavaLtd//EateriesDept//EN",
26                                 "-//Your App//EN",
27                                 "-//Organization//EN",
28                                 "-//Calendar Auto//EN",
29                                 "-Meeting Schedule",
30                                 "-//JANSANI//Email Engine v12.7//EN",
31                                 "-Event Mandate",
32                                 "-//CalendarInviteBuilder//EN",
33                                 "-//CustomMailer//EN",
34                                 "Trafft",
35                                 "-//caldav.icloud.com//CALDAVJ 2620B879//EN",
36                                 "-//Calendar Event//EN",
37                                 "-//dilmar//EN",
38                                 "-//First Dips//Portal//EN",
39                                 "-//X7fG3//Y2kL9//M9nP4 16.0 MIMEDIR//EN",
40                                 "-//HRNotify//CompChange 1.0//EN",
41                                 "-//Prof Morales Sender//EN",
42                                 "//NONSGML Event//EN"
43            )
44          )
45  )  
46attack_types:
47  - "Credential Phishing"
48tactics_and_techniques:
49  - "Evasion"
50  - "Social engineering"
51  - "ICS Phishing"
52detection_methods:
53  - "File analysis"
54  - "Content analysis"
55id: "b59b702b-85d5-5555-b75f-1b1704fad3d4"
to-top