Technical summary: This rule triggers on inbound messages and scans attachments with file_type 'pdf'. It expands the file content (file.explode) and checks for YARA matches using a signature named pdf_rfp_bw_lure. The goal is to detect RFP-themed lure documents used in credential phishing/BEC attempts delivered via PDF attachments. The detection relies on YARA-based file analysis rather than metadata alone. Potential false positives may occur if legitimate PDFs contain related patterns or if attackers modify the lure signature. Mitigations include quarantining or blocking matching PDFs, validating sender/domain reputation, refining the YARA rule to reduce overlap with legitimate content, and monitoring for variations of the pdf_rfp_bw_lure signature."