This rule detects inbound emails/messages that include a PDF attachment matching a known templated lure. It uses a specific YARA signature named pdf_templated_lure_blue_white to identify the recurring phishing technique associated with a blue-and-white design. The rule triggers when an inbound message has a PDF attachment, the file is exploded/read, and the YARA scan reports a match for the named signature. It is intended to surface campaigns that deliver malware/ransomware or steal credentials via socially engineered PDFs. Detection methods rely on YARA-based file analysis coupled with attachment inspection. Data sources focus on the File/Attachment payload; domain corresponds to Application (email/applications) content. Keywords: PDF, lure, phishing, YARA, attachments.