Rule detects inbound messages with ZIP attachments where the filename stored in the local file header (LFH) differs from the filename in the central directory (CD). This mismatch is a known technique in forged or obfuscated ZIP archives used to conceal payloads or evade detection. The rule activates on inbound traffic containing ZIP attachments and checks for the YARA pattern zip_pklfh_cd_fname_mismatch, indicating a potential evasion attempt. Detection relies on archive analysis, YARA scanning, and file analysis to identify anomalous ZIP structures. Classified as low severity, aligned with attack surface reduction and evasion-focused malware/ransomware activity.