This rule detects credential phishing attempts that impersonate document-signing services (e.g., DocuSign) via inbound messages. It targets messages with exactly one recipient and requires two of three indicators to be present: (1) the message body mentions doc signing language (e.g., "DocuSign" or generic "document"); (2) the greeting or body shows personalization tied to the recipient’s domain (for example, phrases like "You're receiving this on behalf of <domain>" or "Invitation to sign document for <domain>"); and (3) the HTML payload contains templated artifacts associated with known fraudulent signing invitations (e.g., language referencing STAR Capital or Agito AS). By enforcing a single-recipient constraint and a two-of-three condition, the rule aims to reduce false positives while catching targeted phishing that leverages brand impersonation and legitimate-looking document-signing workflows. Attack types detected include Credential Phishing and BEC/Fraud, with tactics/techniques centered on Impersonation: Brand and Social engineering. Detection methods rely on Content analysis and HTML analysis of the message body and HTML content. The rule relies on inbound message fields such as body and html, as well as recipient and domain information to identify domain-specific personalization and templated artifacts. This makes it effective against targeted phishing that uses personalized, domain-tocused greetings and signing-invitations to deceive recipients into providing credentials or funds.