This rule flags inbound emails that include an ICS calendar attachment whose embedded event data contains a URL with a fragment that is hex-encoded to match the recipient's email address. It targets phishing campaigns that leverage calendar invites and URL personalization to evade generic link-based detectors. The rule filters inbound messages for attachments with ICS file types or Content-Types (application/ics, text/calendar). It uses a beta ICS parser to enumerate events and their links, decodes the hex-encoded fragment of each link (href_url.fragment), and compares it to the first recipient's email address (recipients.to[0].email.email). If a match is found, an alert is generated. Detection relies on File analysis (attachment content) and URL analysis (link fragments). The rule is categorized as medium severity and associated with ICS Phishing and Credential Phishing techniques. Note that it relies on a beta feature that may change; false positives can occur with legitimate ICS invites carrying non-malicious hex fragments or unusual ICS structures; performance considerations exist due to ICS parsing; privacy considerations apply given access to recipient email data. Recommend pairing with broader email security controls (DKIM/SPF/DMARC) and supplementary heuristics to reduce false positives.