Technical summary: This rule flags inbound email traffic that is routed through Kagoya.net infrastructure (root_domain kagoya.net) and carries an English-language body, aiming to surface business-themed lures used in email-based fraud. It relies on three detection facets: (1) header/domain analysis to confirm the message traverses Kagoya.net (via headers.domains with root_domain == "kagoya.net"), (2) natural language understanding to classify the message body (body.current_thread.text) language as "english", and (3) sender/thread context checks to reduce false positives by excluding typical threaded conversations. The negative clause prevents triggering when the message is part of an existing thread (references or in_reply_to present, subject is forward/reply, and previous threads exist), thereby focusing on potentially unsolicited new outreach rather than legitimate replies or forwards. The rule is categorized as low severity and is designed to detect social-engineering and spoofing tactics used in BEC/Fraud and Spam scenarios, leveraging NLU for language detection, along with header and sender analysis to corroborate the suspicious origin. Detection methods also support abuse mitigation by focusing on infrastructure-linked domains used for deceptive business lures, rather than ordinary conversational email. The rule’s outputs are aligned with Attack Surface Reduction objectives, emphasizing brand impersonation and social-engineering signals in English-language messages from Kagoya.net infrastructure.