Technical summary: This rule flags inbound messages based on a combination of NLP intent and HTML artifacts. It triggers when the NLU classifier on the thread text reports intents cred_theft or bec with a medium or high confidence, and the HTML portion of the message contains HTML comments that match AI-generated invoice template artifacts (e.g., 'PDF icon', 'File row', 'Billing Table', 'CTA Button'). It further excludes messages from highly trusted sender domains unless DMARC authentication fails, ensuring legitimate trusted senders do not trigger false positives. The detection relies on NLU for intent, HTML analysis to inspect comments, and header/sender analysis to evaluate DMARC. The intended attack types are Credential Phishing and BEC/Fraud, with tactics including Social Engineering and Spoofing. This rule is an example of Attack Surface Reduction for email channels and maps to data sources related to inbound message content (body.current_thread.text and body.html) and detection methods that include Natural Language Understanding, HTML analysis, Header analysis, and Sender analysis. The rule aims to catch AI-generated invoice templates used to steal credentials or trigger fraudulent payments while ignoring trusted senders unless DMARC indicates a problem.