This rule detects inbound messages that reference an excessively large guest list and accompany a suspicious link. It requires both conditions to be present: (1) the message body contains the indicator text "(Guest list is too large to display)" signaling a potential phishing lure, and (2) a suspicious URL is present either in the message's direct links or in results from link analysis. The URL checks enforce that the path is the root ("/") and the query parameter appears as an 8-character base64-like string (regex [A-Za-z0-9+/]{8}), with the decoded query parameter value count equal to 1 and all decoded values being empty strings. This pattern suggests an obfuscated or crafted link designed to bypass simple URL checks. The rule is categorized under Credential Phishing and signals evasive social engineering techniques. It leverages both content analysis (text in the thread) and URL analysis (link structure and decoding behavior) to detect malicious payloads in inbound messages from multiple data streams (direct links and link analysis results).