Update attachment_small_txt_suspicious_link.yml (#2038)

sublime-security · Oct 23, 2024 · fc58873 · fc58873
1 parent 4df9974
commit fc58873
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/detection-rules/attachment_small_txt_suspicious_link.yml b/detection-rules/attachment_small_txt_suspicious_link.yml
@@ -6,6 +6,11 @@ source: |
   type.inbound
   and any(attachments,
           .content_type in~ ("text/plain", "text")
+          // negate calendar invites
+          and not (
+                  .file_extension == "ics"
+                  or .content_type in ("application/ics", "text/calendar") 
+                  )
           and any(file.explode(.),
                   .size < 1000
                   and any(.scan.url.urls,