The rule detects inbound messages that impersonate the MyChart brand by requiring: (1) the sender’s display name to contain "mychart"; and (2) the message body to contain branding cues or lure phrases, with the condition that either at least two of a curated lure list appear in the body (e.g., "claim your reward", "member rewards", "feedback survey", "medicare kit", etc.), or the subject line contains "medicare kit", or the sender’s domain is recently registered (days_old < 365). It also flags messages from recently registered domains or domains associated with lure phrases, and uses a copyright-style regex to catch variations like a copyright symbol followed by a number and "mychart". Legitimate MyChart senders from trusted domains that pass DMARC are excluded, as are designated high-trust sender domains unless DMARC fails. The rule negates highly trusted domains that pass DMARC, and excludes specific whitelisted domains (e.g., epic-notification.com, myhealthconnect.org) when DMARC passes. It is categorized as credential phishing and spam, employing content analysis, natural language understanding, header analysis, and sender analysis to identify impersonation, social engineering, and spoofing signals. Potential limitations include legitimate communications using similar branding terms or new domains not yet recognized by the exclusions, which could yield false positives. The rule relies on sender display name, message text, subject, domain age, DMARC status, and a DMARC-based trust model to determine detections.