This rule detects inbound email traffic that originates from the Postman service (sender.email.domain.root_domain == "postman.io") where the reply-to header references a domain different from the sender’s domain, signaling potential abuse of a legitimate service to capture replies and redirect them to an attacker-controlled address. It also requires the message body to trigger credential theft intent via the ML/NLU classifier (ml.nlu_classifier(body.current_thread.text).intents with name == "cred_theft" and confidence != "low"). When both the domain-based header mismatch and the credential-theft intent are present, the rule flags a Credential Phishing event. Detection methods include Sender analysis (verify source domain), Header analysis (validate reply-to domain against sender domain), and Natural Language Understanding (identify cred_theft intent in the thread). Attack types: Credential Phishing. Tactics and techniques: Social engineering, Out of band pivot. This approach leverages a legitimate service to deliver messages while steering replies to attacker-controlled destinations, enabling covert credential collection channels. Operational guidance: bias toward higher scrutiny when postman.io is involved and reply-to mismatches occur, and consider additional checks such as DMARC/SPF/DKIM alignment and inbound mail flow integrity. Be mindful of potential false positives in legitimate cross-domain campaigns and tune NLQ thresholds accordingly. Integrate with incident response for rapid containment and follow-up remediation.