This rule detects inbound short messages that reference an attached document requiring identity confirmation and a code to unlock it within an active thread. It searches the current thread text for the phrases: "confirm your identity", "code to unlock document", and "attached document". The message must be short (length < 500) and part of a multi-turn conversation (length of previous_threads > 1). The intent is credential phishing using social engineering, potentially involving a PDF attachment. Detection relies on content analysis of the thread context (body.current_thread.text and body.previous_threads). The rule is designed to flag suspicious, prompt-based verification flows that push the user to divulge credentials or unlock access via a code. It may generate false positives in legitimate identity-verification workflows (e.g., customer support or secure document delivery) and can be evaded by rewording, extending the message length, or altering the phrasing to avoid the exact keywords. It does not analyze the attachment content itself, only textual cues from the thread. To reduce false positives, consider expanding phrase coverage, incorporating attachment-type verification, and leveraging sender reputation or metadata around the conversation.