This rule detects inbound email messages that contain an HTML image map where both the image source (img[@usemap]/@src) and the clickable areas (area/@href) resolve to amazonaws.com. The technique leverages trusted cloud storage (AWS S3) to host deceptive content and hide malicious links behind an interactive image, aiding evasion of traditional link-based filters. It uses HTML analysis to locate the image map in the email body and extract the relevant URLs, followed by URL analysis to confirm that the root domain for both the image source and the area href is amazonaws.com. If both are AWS-hosted, the rule fires at a medium severity. This targets credential phishing and spam campaigns that abuse a trusted cloud service to disguise links. Detection methods include HTML analysis and URL analysis. Tactics and techniques include Image as content and Free file host. Data source focuses on image content delivered via inbound emails. Domain/asset scope includes Web content and Cloud/AWS hosting. Potential false positives may arise from legitimate AWS-hosted image maps used in marketing or documentation; additional context (sender reputation, DKIM/SPF alignment) can help reduce noise.