This rule flags BEC/Fraud scenarios where an apparent self-reply in an established email thread introduces a first non-mailto link that points to a domain unrelated to the sender and not present in prior thread history (accounting for Mimecast link wrapping). It verifies the sender was a genuine participant in earlier messages, ensures no organizational recipients or domains from the earlier history are in play, and detects a newly introduced, unrelated link that could redirect the conversation via a compromised external account. The rule analyzes the current thread, previous threads, links, headers, and sender/recipient metadata to identify potential account takeover and out-of-band pivot behavior.