This rule detects inbound messages that impersonate the U.S. federal court system or related judiciary services (e.g., PACER, jury summons, clerk of court) with the intent to steal credentials. It uses a two-pronged approach: (1) NLU-based detection of court-related sender entities and credential-theft intents within the email body, and (2) a pattern-based check for multiple suspicious phrases or identifiers commonly used in court-notice phishing (e.g., PACER, the real looking phone number 1-800-676-6856, “contempt charges,” “Official Court Notice,” “jury summons,” “juror number,” “complaint has been filed against you”). The rule requires either a recognized cred_theft intent with a sender entity that references U.S. courts, or at least two of the listed keyword/phrase indicators to trigger an alert. It excludes legitimate newsletters and highly trusted domains that pass DMARC authentication, and it explicitly negates the actual federal judiciary or trusted senders if DMARC passes, to reduce false positives. The rule is designed to detect Credential Phishing through Impersonation, Social engineering, and Spoofing, employing detection methods such as Natural Language Understanding, Content analysis, Header analysis, and Sender analysis to assess both the message content and provenance.