This rule detects inbound messages that contain PDF attachments which match a specific YARA signature named pdf_quickbooks_payment_image_lure. It targets social-engineering BEC/credential phishing campaigns impersonating QuickBooks by delivering a payment image lure within a PDF. The detection flow requires an inbound event, filters for attachments of type pdf, explodes the file contents, and runs a YARA-based match against the pdf_quickbooks_payment_image_lure signature. A successful match triggers the rule at a medium severity level. Detection methods include YARA-based file content analysis to identify the known lure pattern. The rule is purpose-built for attachment-based phishing attempts leveraging brand impersonation and PDF assets to prompt user action. Potential limitations include the need for the YARA rule to remain up-to-date to cover evolving lures and the possibility of false positives if legitimate PDFs accidentally trigger the signature. Operators should complement this with user education and cross-checks for payment requests to mitigate BEC risk.