Detects ICS calendar invites delivered as attachments from free email providers (e.g., Outlook.com, Hotmail) that mimic a 'shared a photo/file with you' notification. The rule targets inbound emails containing ICS attachments (.ics, content_type application/ics/text/calendar) and uses a beta ICS parser to inspect the event payload as rendered by calendar clients (not the obfuscated HTML body). It flags invites whose description contains file-sharing language detected via NLP topics (notably the 'File Sharing and Cloud Services' category) or via a regex matching phrases like "shared a folder with you" (and related variants). Suspicious intent is confirmed when the invite organizer is a groups.outlook.com self-invite or when links within the ICS redirect through Google domains (e.g., google redirectors or search.app) rather than legitimate Google Drive domains. The rule excludes highly trusted sender domains unless DMARC authentication fails, reducing noise from legitimate senders. This is categorized as Credential Phishing due to the lure to click/authorize or access shared content leading to credential exposure. Detection methods include file analysis (ICS payload parsing), natural language understanding (NLU) for file-sharing themes, content analysis (description), URL analysis (redirectors), and sender/header checks (DMARC). The rule is intended for inbound email processing and leverages domain-based sender filtering to focus on free-email providers.