This rule detects inbound messages attempting credential theft by abusing an ICS calendar attachment. It first requires the email body to contain the exact placeholder text “(Guest list is too large to display)”. It then validates the presence of an ICS file attachment (ics file_type/file_extension or content_type of application/ics or text/calendar). Using a beta ICS parser, it enumerates the calendar events and applies an NLU classifier to each event’s summary and description. If any event yields an intent named cred_theft with non-low confidence, the rule triggers. To reduce false positives, messages from domains on the high-trust allowlist that also pass DMARC are excluded. The rule notes that the ICS parsing feature is beta and subject to change.