Detects inbound emails containing ICS calendar attachments where parsed ICS events include links to free file hosts, self-service creation platforms, suspicious top-level domains, URL shorteners, or recently registered domains. Verifies threat by identifying minimal JavaScript landing pages that load only a script and a favicon, a pattern often used to redirect victims to malicious content while avoiding detection. Excludes messages from highly trusted, DMARC-passing senders. The rule parses ICS attachments, inspects event links, and compares link domains against whitelists/blacklists (free hosts, self-service domains, suspicious TLDs, shorteners) and Whois age (<90 days). For the minimal landing page, it requires exactly three unique URLs accessed and ensures each URL either matches the ICS link, starts with the ICS URL and ends with .js, or equals the ICS URL plus favicon.png. If all conditions are met, an alert is raised. Attack types include ICS Phishing and Credential Phishing; detection methods encompass File analysis, URL analysis, Whois, Javascript analysis, and Content analysis.