Detects inbound messages that include ICS calendar attachments where the embedded event description contains procurement-fraud lure language related to bidding/RFPs. The rule parses the ICS file contents (via a beta ICS parser) and inspects events for phrases inviting participation in bidding, pre-bid meetings, or access to bid documents. If such language is found, the rule then analyzes any external links within the message to ensure a domain mismatch with the sender's domain and to identify risk indicators such as hosting on self-service/build platform domains, free file hosting or subdomain services, suspicious TLDs, URL shorteners, or recently registered domains (WHOIS age < 90 days). This combination signals a potential ICS phishing/BEC attempt focused on procurement fraud. Detection relies on file analysis (ICS parsing), content analysis (event description), URL analysis, and Whois checks. Severity is medium, aligned with threats like BEC/Fraud and ICS Phishing, and uses techniques including social engineering, exploitation of free hosting/subdomain services, and lookalike domains.