This rule detects inbound emails that carry a PDF attachment which references the lure text "VIEW RFP DOCUMENT" and includes at least one URL embedded within the file that resolves to a domain different from the sender's domain. This pattern aligns with document-based social engineering intended to redirect recipients to attacker-controlled infrastructure for credential theft or further malware delivery. The rule leverages file content analysis to spot the PDF and specific strings, and URL analysis to identify external links within the PDF that do not match the sender's domain. A match is triggered when a PDF contains the lure string and at least one non-mailto URL whose domain differs from the sender's domain. Severity is high, reflecting the credential-phishing risk posed by such lures.