This rule detects inbound email messages that contain ICS calendar attachments with event descriptions referencing financial terminology (credit notes, billing adjustments, invoice reconciliation) and that include links in the email body pointing to URL shorteners, suspicious TLDs, newly registered domains, free file hosting services, or self-service platforms. It additionally enforces domain-mismatch checks between the sender domain and link domains, and excludes messages from high-trust senders that pass DMARC. The rule relies on a beta ICS parsing feature to extract ICS event descriptions and compares them against multiple patterns related to credit notes and invoices. For links, it requires a sender-domain mismatch and evaluates the link domain against whitelists/blacklists (URL shorteners, suspicious TLDs, newly registered domains, free file hosts, and self-service platforms). This combination aims to surface financial-lure phishing or BEC attempts that attempt to trick recipients into interacting with fraudulent financial references or external services, while reducing false positives against trusted senders with DMARC authentication.