This rule detects credential phishing attempts embedded in inbound emails that misuse the legitimate Power BI domain (app.powerbi.com) to host or redirect to phishing pages. It triggers when an inbound email contains a link whose domain is app.powerbi.com with a path starting with /view, and the email body includes lure text patterns commonly used to entice recipients to open a supposedly shared document, file, or proposal. The combination of a trusted-looking URL and convincing body copy (e.g., references to a shared document, and phrases like “review the attached” or “can only be viewed/opened/accessed”) signals an impersonation of a Power BI-sharing workflow and potential credential harvesting. The rule uses URL analysis to verify the link’s domain and path, alongside content analysis to detect social-engineering text. This maps to Credential Phishing tactics and leverages the “Free file host” social-engineering vector. It is designed to reduce travel-time to credential pages by exploiting trust in Power BI’s legitimate service while relying on content patterns commonly associated with phishing, enabling rapid detection of drive-by credential attempts in email gateways or endpoints.