This rule detects inbound email messages that pretend to be replies in an ongoing conversation by leveraging an In-Reply-To header, yet contain no prior thread history in the body. The subject pattern requires a dash, then the token wbx, then a three-letter code (e.g., “- wbx abc”), mimicking Webex meeting notifications. The combination signals a mass-distributed social-engineering tactic aimed at bypassing casual readers by appearing as a legitimate scheduling continuation. Detection relies on: (1) header analysis to verify the In-Reply-To is present and non-trivial, (2) content analysis to confirm there are no existing previous_threads, and (3) subject analysis to enforce the wbx tag with a three-letter suffix. This aligns with attacks categorized as BEC/Fraud, Spam, and Reconnaissance, employing social engineering, free email providers, and spoofing techniques to prompt user engagement with an embedded lure. Potential false positives may arise from legitimate emails that resemble reply threads or calendar invites with similar subject formatting, so tuning thresholds and cross-checks with user behavior are recommended.”