Skip to content

Create attachment_ics_meeting_invite.yml #3756

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
MSAdministrator wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Create attachment_ics_meeting_invite.yml #3756

MSAdministrator wants to merge 11 commits into from
+23 −0

Conversation

@MSAdministrator
Copy link
Member

@MSAdministrator MSAdministrator commented Jan 12, 2026 •
edited
Loading

Description

Identified a few samples related to a fake meeting invite using ICS and the word meeting_ in the file name itself.

Associated samples

Associated hunts

@MSAdministrator MSAdministrator self-assigned this Jan 12, 2026
@MSAdministrator MSAdministrator requested a review from a team as a code owner January 12, 2026 17:49
@MSAdministrator MSAdministrator added the in-test-rules PR is in our testing suite to collect telemetry label Jan 12, 2026
@github-actions github-actions bot removed the in-test-rules PR is in our testing suite to collect telemetry label Jan 12, 2026
@github-actions github-actions bot added the in-test-rules PR is in our testing suite to collect telemetry label Jan 12, 2026
github-actions bot added a commit that referenced this pull request Jan 12, 2026
@github-actions
[PR #3756] added rule: Attachment: ICS file with meeting prefix
e3a9526
@MSAdministrator MSAdministrator added the review-needed Indicates that a PR is waiting for review label Jan 14, 2026
github-actions bot added a commit that referenced this pull request Jan 14, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
26fa126
zoomequipd
zoomequipd requested changes Jan 14, 2026
View reviewed changes
@zoomequipd zoomequipd removed the review-needed Indicates that a PR is waiting for review label Jan 14, 2026
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] added rule: PR# 3756 - Attachment: ICS fil…
502af90 
…e with meeting prefix
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] added rule: Attachment: ICS file with meet…
7e2a1a5 
…ing prefix
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] Delete detection rule
218a92d
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] Delete detection rule
5b02615
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] added rule: PR# 3756 - Attachment: ICS fil…
c4ff30b 
…e with meeting prefix
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 16, 2026
@github-actions
[PR sublime-security#3756] added rule: Attachment: ICS file with meet…
4fb3d6f 
…ing prefix
@MSAdministrator MSAdministrator requested a review from a team as a code owner January 20, 2026 18:48
github-actions bot added a commit that referenced this pull request Jan 20, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
26b7373
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 20, 2026
@github-actions
[PR sublime-security#3756] modified rule: PR# 3756 - Attachment: ICS …
fa685b7 
…file with meeting prefix
github-actions bot added a commit to aidenmitchell/sublime-rules that referenced this pull request Jan 20, 2026
@github-actions
[PR sublime-security#3756] modified rule: Attachment: ICS file with m…
0d7a062 
…eeting prefix
github-actions bot added a commit that referenced this pull request Jan 21, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
8ebd212
@MSAdministrator MSAdministrator added the review-needed Indicates that a PR is waiting for review label Jan 23, 2026
github-actions bot added a commit that referenced this pull request Jan 23, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
5bbf3b1
zoomequipd
zoomequipd requested changes Jan 23, 2026
View reviewed changes
@MSAdministrator @zoomequipd
Update detection-rules/attachment_ics_meeting_invite.yml
234b786 
Co-authored-by: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com>
@MSAdministrator
Copy link
Member Author

MSAdministrator commented Jan 23, 2026

Updated hunt

zoomequipd
zoomequipd requested changes Jan 23, 2026
View reviewed changes
zoomequipd
zoomequipd requested changes Jan 23, 2026
View reviewed changes
github-actions bot added a commit that referenced this pull request Jan 23, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
7032e4f
github-actions bot added a commit that referenced this pull request Jan 23, 2026
@github-actions
[PR #3756] modified rule: Attachment: ICS file with meeting prefix
5756073
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zoomequipd zoomequipd Awaiting requested review from zoomequipd

Requested changes must be addressed to merge this pull request.

Assignees

@MSAdministrator MSAdministrator

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MSAdministrator @zoomequipd @aidenmitchell