Create attachment_ics_meeting_invite.yml

detection-rules/attachment_ics_meeting_invite.yml

@@ -0,0 +1,26 @@
+name: "Attachment: ICS file with meeting prefix"
+description: "Detects incoming messages with a single ICS calendar file attachment that has a filename starting with 'meeting_'."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and length(attachments) == 1
+  and any(filter(attachments, .content_type == "text/calendar"),
+          (
+            regex.contains(.file_name, "meeting_[a-zA-Z]{5}")
+            or regex.contains(.file_name, "meeting_[a-zA-Z0-9]{5}")
+          )
+          and not (
+            regex.contains(.file_name, "meeting_invit[eation]")
+            or regex.contains(.file_name, "meeting_request")
+          )
+  )
+attack_types:
+  - "BEC/Fraud"
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "File analysis"
+  - "Header analysis"
+id: "383a5810-0b85-55a8-ac9b-e7135823317b"