This rule detects inbound messages that carry ICS calendar attachments in which a parsed event includes an embedded RFC822 email payload stored as a base64-encoded attachment, rather than a simple URL reference. The technique is designed to evade attachment scanning by delivering a nested email payload inside a calendar invite. Detection relies on a beta ICS parsing feature to examine ICS events within inbound attachments. For any parsed ICS event, the rule inspects attachments and requires that the payload appears embedded (as indicated by a non-null MD5). It then checks for either a direct attachment with file_extension == "eml" or a raw property named ATTACH with a FMTTYPE parameter containing "message/rfc822". When these conditions are met, the ICS invite is flagged as carrying a nested RFC822 payload. This pattern can be used for malware/ransomware delivery or credential phishing via a disguised email payload inside a calendar invite, representing a defensive evasion technique.