This rule detects inbound messages that use a document-page reference lure to appear legitimate in fraud attempts (BEC/credential phishing). It inspects the inbound thread body (body.current_thread.text) with a case-insensitive hex-encoded pattern that effectively searches for the phrase "on pages <digit><lowercase_letter> and <digit><lowercase_letter>". Example matches include phrases like "Please review on pages 3a and 4b" or similar variations. The hex encoding in the rule (\x6f\x6e\x20\x70\x61\x67\x65\x73 \d[a-z] \x61\x6e\x64 \d[a-z]) is used to deter naive string matching. This technique targets social-engineering workflows involving document review or signature requests and is consistent with BEC and credential phishing patterns. Detection uses content analysis and can be complemented by threat intelligence. The rule is marked with medium severity, reflecting its targeted but potentially lower-volume risk profile and the potential for false positives if legitimate communications reference pages or sections in a document.