This rule detects inbound emails containing ICS calendar attachments where the parsed ICS event description is classified by the embedded Natural Language Understanding (NLU) classifier as having high-confidence credential theft intent and high-confidence Financial Communications topic. It targets ICS attachments by file_type, file_extension, or content_type and uses a beta ICS parser to extract events. For each event, it requires the NLU classification of the event description to include a cred_theft intent with high confidence and a Financial Communications topic with high confidence. It further inspects links embedded within the ICS: a link must point to a domain whose root differs from the sender’s domain root and must match one or more risky categories (self-service creation platforms, free file hosts, free subdomain hosts, URL shorteners, suspicious TLDs, or newly registered domains less than 90 days old, as determined by Whois). The rule excludes obvious legitimate mail by ignoring subjects starting with accepted/declined prefixes and by requiring that the sender’s domain not be in a predefined set of high-trust domains with valid DMARC pass. When all conditions are met, the rule triggers a detection for credential-theft–driven ICS phishing. It is labeled with Attack Surface Reduction, encompasses ICS Phishing and Credential Phishing as attack types, and leverages detection methods including File analysis, Natural Language Understanding, URL analysis, and Whois checks. Note: the rule uses a beta ICS parsing feature and is subject to change; it is not recommended for formal production deployment until released.