This rule detects inbound messages containing two or more links where the URL path includes long base64-encoded segments that, when decoded, reveal additional base64-like content. The detection targets double-encoding patterns used to obfuscate the final destination and evade automated URL inspection. It analyzes link paths (href_url.path) for patterns like /[A-Za-z0-9+/]{80,}={0,2}, decodes the captured base64 payload, and checks whether the decoded content contains further base64-like sequences of length >= 60. The rule excludes highly trusted root sender domains if DMARC authentication passes, focusing on likely malicious or evasive traffic. Attack type: Credential Phishing. Tactics/Techniques: Encryption, Evasion. Detection methods: URL analysis, Content analysis. Data considered comes from inbound message content (type.inbound) and the body links, with decoding and pattern-matching logic applied to the URL paths to identify obfuscated destinations.