This rule detects inbound email messages that start with the greeting “Dear Prospective Bidder,” and leverage a Google Drive-hosted PDF lure image/icon within a complex HTML table structure. It requires the message body to contain the greeting (body.current_thread.text), and the HTML portion (body.html) to include a table-based layout whose displayed text ends with “.pdf”. It also requires the raw payload to include the specific Google Drive PDF URL (https://drive-thirdparty.googleusercontent.com/16/type/application/pdf). When all conditions are met, the rule flags the message as a potential phishing/BEC/fraud attempt that uses social engineering to induce the recipient to engage with a PDF document hosted on Google Drive. This rule does not execute payloads; instead, it analyzes content to generate alerts and support containment actions.