Attachment: ICS calendar file with suspicious UID domain

 1name: "Attachment: ICS calendar file with suspicious UID domain"
 2description: "Detects inbound messages containing ICS calendar attachments whose event UID ends with a known-malicious domain (@example.com) or contains a known bulk-invite automation toolkit identifier (mr-calendar-automation). Because the UID is client-supplied and passed through unmodified by calendar providers, it exposes attacker tooling even on invites relayed by legitimate, authenticated infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or .file_extension == "ics"
11            or .content_type in ("application/ics", "text/calendar")
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.file.parse_ics(.).events,
18                  strings.iends_with(.uid,
19                                     "@example.com",
20                                     "mr-calendar-automation"
21                  )
22          )
23  )  
24tags:
25  - "Attack surface reduction"
26attack_types:
27  - "Credential Phishing"
28  - "BEC/Fraud"
29tactics_and_techniques:
30  - "Social engineering"
31  - "ICS Phishing"
32detection_methods:
33  - "File analysis"
34  - "Content analysis"
35id: "cbe06f4f-f041-501b-bfc0-957cd545cd83"