Attachment: Meetergo booking link

calendar Oct 9, 2026  ยท
Share on: linkedin copy

Detects inbound messages containing an attachment that embeds a link to a Meetergo scheduling page.

Sublime rule (View on GitHub)

 1name: "Attachment: Meetergo booking link"
 2description: "Detects inbound messages containing an attachment that embeds a link to a Meetergo scheduling page."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  
 8  // booking link within attachment
 9  and any(attachments,
10          any(file.explode(.),
11              any(.scan.url.urls,
12                  strings.starts_with(.url, "https://cal.meetergo.com/d")
13              )
14          )
15  )  
16
17attack_types:
18  - "BEC/Fraud"
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Social engineering"
22  - "Evasion"
23detection_methods:
24  - "File analysis"
25  - "URL analysis"
26id: "eac13f5c-2055-5cd4-8eec-4f6db696baa3"
to-top