This rule targets inbound messages that carry PDF attachments and checks them with a YARA rule named pdf_ITA_signature_lure to detect USDOC ITA signature lure activity. It triggers when an inbound event contains at least one attachment with file_type pdf, then explodes the file (recursively analyzes embedded/content streams) and evaluates YARA scans for a match with the specified rule name. A match indicates potential credential phishing or malware/ransomware delivery via a lure PDF. The rule relies on file analysis complemented by YARA classification. The presence of the pdf_ITA_signature_lure signature in an inbound PDF suggests a USDOC ITA-themed lure, enabling proactive blocking or isolation of suspicious attachments. Dependence on the availability and updating of the pdf_ITA_signature_lure YARA rule means accuracy is tied to rule freshness; false positives may occur if benign PDFs share overlapping signatures, and it will not flag non-PDF email content unless extended. Recommended actions include automated quarantine, user notification, or sandboxing for matched items, with ongoing YARA rule maintenance to minimize drift and false positives.