Detects inbound messages containing PDF attachments that match a YARA signature identifying content associated with SSA-themed lures. The rule triggers when an inbound attachment has file_type "pdf" and the PDF content, when scanned, matches the YARA rule named pdf_ssa_lure. This indicates potential credential phishing via impersonation of the Social Security Administration and is designed to surface SSA-branded social engineering attempts embedded in attachments. It combines file analysis with YARA-based content classification to flag suspicious inbound documents intended to lure credentials. Severity is medium, reflecting typical phishing risk from document-based lures.