Detect inbound messages containing ICS calendar attachments that exploit Google Calendar's "Guest list is too large to display" behavior to mass-invite unrelated recipients, obscuring the true scale of the send. The rule requires an inbound message body containing the exact guest-list phrase, and at least one ICS attachment (identified by file_type, file_extension, or content_type). It then parses the ICS content (via a beta ICS parser) to examine events for voicemail-related pretexts, checking for a NLU-defined topic named "Voicemail Call and Missed Call Notifications" with non-low confidence. If a match is found, the message is evaluated against sender reputation (excluding messages from high-trust domains when DMARC passes) before triggering. This detects social-engineering phishing/BEC campaigns that abuse calendar invites and voicemail pretexts to lure recipients and potentially mass-distribute the intrusion.