This rule detects credential theft attempts embedded in inbound email with an empty body that carry a PDF attachment manipulated to resemble a document portal or review invitation. It looks for a PDF attachment whose text includes phrases like "document portal", "invited to review", or "confidential document". It also requires the attachment text to contain the recipient’s own email address. The content is further validated by a natural language understanding (NLU) classifier, requiring an intent named "cred_theft" with high confidence. Messages from highly trusted sender domains are excluded if they pass DMARC authentication. The rule flags credential phishing attempts that leverage social engineering via PDFs and portal-like messaging. It uses file analysis and content analysis to inspect the attachment, NL U classification to assess intent, header analysis to review DMARC results, and sender analysis to evaluate sender trust. Attacker goals include credential theft through fraudulently disclosed document portals or review invitations. Potential evasion could involve obfuscated text or alternate phrases not captured by the current language cues, or DMARC failures from otherwise trusted senders to bypass the exclusion logic.