Detects inbound email messages that (1) have a reply-to address differing from the sender's address, (2) reference a contract agreement or order with an 8-digit numeric identifier in the subject, and (3) mention an attached contract or order in the body. This combination is commonly used in business email compromise (BEC) campaigns to redirect replies to an attacker-controlled mailbox. The rule uses header analysis (checking that headers.reply_to exists and != sender.email) and content analysis (subject.subject matches (?:contract agreement|order)_\d{8}\b and body.current_thread.text contains attached (?:contract agreement|order)). This heuristic targets attacker intent to harvest replies and further social engineering. Expected detections include mismatched reply paths paired with contract/order-themed subject lines and attached-contract language. Potential false positives may arise from legitimate processes that legitimately use different reply-to addresses or template phrases. Consider corroborating signals such as sender authentication (DMARC/SPF/DKIM), domain reputation, and unusual forwarding patterns to reduce noise. Classified as BEC/Fraud with spoofing and social engineering techniques, and detected via header and content analysis.