This inbound-detection rule flags messages that attempt to deliver a risk-assessment PDF accompanied by an inline image referenced in the HTML body. It requires both a PDF attachment whose filename matches the pattern “risk assessment [a-z]{2,4}[0-9]{6}” and at least one image attachment that is inline and referenced by a content-id in the HTML body. The rule excludes messages from highly trusted sender domains when DMARC authentication passes, reducing false positives for legitimate mail. Detection relies on file analysis (PDF and image attachments), HTML analysis (inline image reference via content-id), header/sender analysis (DMARC status and sender domain), and inbound-message context. It is categorized as high severity with attack types including Malware/Ransomware and Spam, and techniques including Image as content, PDF usage, and Social engineering. If a trusted DMARC-passing sender triggers are present, the rule will not fire; otherwise, the combination of a suspicious PDF name and an inline image reference in HTML constitutes the signal. Potential coverage gaps include benign uses of risk-assessment PDFs or legitimate inline images; ensuring accurate DMARC data and maintaining the high-trust domain list will help minimize false positives. This rule complements broader anti-phishing controls by tying a named document pattern to an embedded visual lure, leveraging both attachment and HTML content signals to detect steganographic-like delivery vectors and phishing attempts.