This inbound rule targets ICS calendar file attachments (.ics) that, when parsed, reference real estate transaction documents (e.g., closing disclosures, settlement statements, or 1099-S forms) to surface social-engineering fraud commonly seen in BEC attempts. It filters inbound messages for attachments with an ICS mime type/extension, uses a beta ICS parser to extract events, and analyzes event content (summary/description) for indicators such as phrases signaling a file attachment or references to the document type. It also inspects linked content within ICS events (links with view text) and searches for real estate fraud signals like mentions of 1099-S or settlement-related terms (e.g., closing disclosure, settlement statement). The detection aims to identify fraudulent calendar-based lures attempting to prompt recipients to review or act on real estate transaction documents via calendar invites.