Detects inbound emails containing an ICS calendar attachment where the event description mimics a voicemail notification and includes a link to potentially malicious hosting or tooling. The rule analyzes ICS content (beta ICS parsing) for voicemail-related keywords (e.g., 'new voicemail', 'listen to your voicemail') and inspects any links in the message to determine if they point to free file hosting, self-service creation platforms, URL shorteners, suspicious TLDs, or domains registered within the last 90 days. It excludes messages from high-trust sender domains that pass DMARC authentication. Detection methods include file analysis (ICS attachment), content analysis (ICS event description), URL analysis, Whois (domain age), and header analysis. Attacker techniques include social engineering to lure clicking, using free hosting or shortening services to obscure payloads, and evading detection. The rule is categorized under ICS Phishing and Credential Phishing.