Detect inbound emails with ICS calendar attachments that exploit Google's "Guest list is too large to display" behavior to mass-invite large numbers of unrelated recipients and obscure the true scope of a fraudulent purchase order or bid request. The rule parses the ICS content (via a beta ICS parser) and applies natural language understanding (NLU) to the event details, flagging events whose topics include a non-low confidence match for "Purchase Orders". It excludes high-trust senders that have a valid DMARC pass. The detection combines file analysis of the ICS attachment, content analysis of calendar event fields, NLU topic classification, sender/reputation checks, and header analysis. Attacks are categorized as ICS phishing and BEC/fraud, leveraging social engineering and impersonation of a legitimate brand to induce engagement.