Attachment: ICS calendar file with recipient address in UID field

 1name: "Attachment: ICS calendar file with recipient address in UID field"
 2description: "Detects inbound messages containing ICS calendar attachments where the UID property matches the recipient's email address, indicating potential calendar-based social engineering."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (
 9            .file_type == "ics"
10            or (
11              .file_extension == "ics"
12              or .content_type in ("application/ics", "text/calendar")
13            )
14          )
15          //
16          // This rule makes use of a beta feature and is subject to change without notice
17          // using the beta feature in custom rules is not suggested until it has been formally released
18          //
19          and any(beta.file.parse_ics(.).events,
20                  .uid == recipients.to[0].email.email
21          )
22  )
23    
24attack_types:
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Social engineering"
28detection_methods:
29  - "File analysis"
30  - "Content analysis"
31id: "507d814e-1db5-56ce-929f-13c4c78b345f"