This rule flags inbound emails containing PDF attachments that trigger a YARA signature named pdf_generic_msft_compensation_lure. It targets Microsoft-branded compensation lure phishing where attackers impersonate Microsoft to obtain credentials. The detection workflow filters inbound messages for PDF attachments, expands the file content, and applies a YARA scan; a match on the pdf_generic_msft_compensation_lure signature causes the rule to fire. It relies on YARA-based file analysis of the attachment rather than content keywords, enabling detection of attachments used in credential-phishing and BEC/fraud campaigns associated with brand impersonation.