This rule detects inbound email messages that carry an ICS (.ics) calendar attachment used to impersonate legitimate meeting invites and harvest clicks or credentials. It triggers when an inbound message contains an ICS attachment (file_type == "ics" or file_extension == "ics" or content_type in ("application/ics", "text/calendar")). It requires two of four body cues (e.g., 'join the meeting now', 'reset dial-in pin', 'find a local number', 'phone conference id'), and a hyperlink within the message that redirects via a path starting with "/ls/click" where the link’s domain root matches the sender’s domain root. This indicates a tracking/open-redirect mechanism tied to the sender’s identity. It also requires two of several subject heuristics, including phrases like 'management progress meeting', 'project closeout report', 'project implementing agreement kick-off', or a personalized/timestamped format such as 'Discussion w/ <Company>:' or a machine-generated timestamp at the end of the subject. The combination of ICS delivery, domain-aligned open redirects, and templated or timestamped subjects aligns with phishing kits designed to harvest clicks or credentials. The rule uses multi-layer checks across attachment analysis, body content, link analysis, subject patterns, and sender-domain correlation to reduce false positives while flagging impersonation-based ICS phishing attempts. Attack surface: inbound emails targeting endpoints with calendar-based lure; Detection types: ICS Phishing, Credential Phishing; TTPs: Social engineering, Impersonation/Brand spoofing, Open redirect.