This rule detects inbound messages that include ICS calendar attachments containing links to a Google share URL form (google.<tld>/share.google?q=<code>). It leverages a beta ICS parser to extract events and examine embedded links. The detector flags links where the link domain's SLD is google, the path starts with /share.google, and a q query parameter is present. This indicates an attacker-controlled destination masquerading under a trusted Google subdomain, potentially enabling open redirect or credential phishing via calendar invites. The rule is marked as medium severity and notes that the beta parsing feature may change without notice. It targets social engineering through calendar invites and link-based redirection within inbound messages.