This inbound detection rule targets email messages that contain the literal phrase "(Guest list is too large to display)" in the body and include an ICS calendar attachment. It leverages a beta ICS parsing capability to extract events from the attachment and then runs an Natural Language Understanding (NLU) classifier on the ICS event summary and description fields. If any event text yields an intent named 'bec' with a non-low confidence level, the rule flags the message as potential Business Email Compromise (BEC). To reduce false positives from legitimate senders, the rule excludes messages from root domains considered high-trust when DMARC authentication passes. The rule uses multiple detection methods: content analysis of the email body and ICS event text, file analysis of the ICS attachment, and header analysis via DMARC results. The associated attack type is BEC/Fraud with the tactic of Social Engineering. Note that the ICS parsing is a beta feature and may evolve. Limitations include reliance on ICS parsing fidelity, the NLP model’s coverage for BEC intents, and the possibility that clever calendar content or DMARC misconfigurations could affect detection. The rule is designed to catch attempts where fraudsters attempt to leverage calendar invites and ICS data to influence recipients, while reducing noise from trusted, authenticated senders.