This rule detects inbound emails where the sender’s local-part is crafted to mirror the recipient’s domain and mailbox, creating an address pattern like domain_mailbox. It triggers when the sender email local_part equals the concatenation of recipients.to[0].email.domain.sld, an underscore, and recipients.to[0].email.local_part, while the sender’s root_domain is different from the recipient’s root_domain. Such construction is commonly used to spoof an organization’s identity and blend in with legitimate traffic, facilitating BEC or credential harvesting attempts. The detection relies on header and sender analyses to correlate the apparent sender with the intended recipient’s context and to identify cross-domain impersonation. The rule’s low-severity designation suggests it should be used in conjunction with other controls (e.g., DMARC, user warnings) to reduce false positives and address legitimate aliasing scenarios. In practice, analysts should review flagged messages for potential spoofing indicators, and correlate with other signals (threat intelligence, domain reputation, and authentication results) to determine risk posture.