This rule detects inbound PDF attachments that contain specific YARA signatures indicating a secure-document acknowledgment lure. It inspects inbound content, requiring a PDF attachment, and then analyzes the file with YARA to identify two rule names: pdf_prompt_ack_secure_document_link and pdf_prompt_ack_secure_document_image_sizes. When a match is found, the detection fires with medium severity. The rule leverages content analysis, file analysis, and YARA-based detection to catch credential-phishing attempts that rely on social-engineering prompts (acknowledging a secure document, clicking links, or interpreting image sizing) and impersonates a brand to appear legitimate. It is designed for gateways or endpoints processing inbound messages and attachments, aiding in early detection of document-based lures in email or web-driven channels. Operators can tune by adjusting the included YARA rule names, adding contexts, or refining attachment permitting rules to reduce false positives while preserving coverage of authentic document-based phishing attempts.