This rule detects inbound emails containing ICS calendar attachments in which embedded event links contain a randomized 8-character base64 query parameter with no assigned value. It leverages a beta ICS parser to extract calendar events and inspect their links. For each link, it checks that the path is '/' and that the query string includes an 8-character base64 string, that the decoded/query-param structure results in exactly one parameter, and that the decoded parameter value is empty (valueless). Messages from high-trust sender domains that pass DMARC authentication are excluded to reduce false positives. Detection relies on file analysis (attachment parsing), URL analysis (link and query-parameter inspection), and header analysis (DMARC status). The rule targets ICS phishing and credential phishing attempts that use evasion techniques via ICS links embedded in calendar invites. Note that the rule uses a beta ICS parsing feature and may change as the feature evolves. It is designed to identify social-engineering-driven attacks that leverage calendar events to trigger interactions with malicious endpoints, potentially facilitating credential theft or credential-exfiltration workflows.