Detects inbound emails containing PDF attachments that match the YARA signature pdf_blue_oneDrive_lure_structure, indicating a blue-themed OneDrive phishing lure designed to steal credentials. The rule requires an inbound data source, filters attachments for PDFs, and analyzes each file's content (explode) using YARA to detect structured lure patterns. If a match to the pdf_blue_oneDrive_lure_structure signature is found, the rule triggers. It leverages File analysis and YARA scanning as detection methods. The rule maps to Credential Phishing, with tactics including handling PDFs, brand impersonation (OneDrive), and social engineering to prompt user action. This rule targets a specific lure pattern in enterprise email to reduce credential theft risk.