This rule detects inbound email messages that carry PDF attachments which trigger a YARA signature named pdf_enc_adobe_lure. It targets credential phishing campaigns that use encrypted or password-protected PDFs designed to resemble Adobe communications to entice recipients. The detection workflow filters for inbound mail, selects attachments whose file_type is pdf, and then expands nested content (file.explode) to perform a YARA scan. If any file matches the pdf_enc_adobe_lure signature, the rule raises an alert. The approach combines YARA-based pattern matching with file analysis to identify encrypted or obfuscated PDF content intended to bypass simple checks. This helps surface attempts to lure users into revealing credentials or clicking malicious prompts within an ostensibly legitimate Adobe-themed document. Recommended responses include quarantining or flagging the message for security review and performing follow-up investigation on the attachment and sender.