This rule detects inbound emails that carry PDF attachments which match a specific YARA signature, pdf_blue_oneDrive_lure_2, indicating a blue-themed OneDrive branding lure used in credential phishing. The detection triggers when an inbound event includes a PDF attachment and the file content, when exploded for analysis, yields a YARA match with the signature name pdf_blue_oneDrive_lure_2. It leverages YARA-based file analysis to identify known lure patterns embedded in PDFs designed to impersonate OneDrive and prompt credential input or information disclosure. The rule is categorized as medium severity and is aligned with Credential Phishing, leveraging PDF delivery, brand impersonation, and social engineering techniques. Detection methods include YARA scanning and general file analysis. Potential false positives may occur if legitimate PDFs inadvertently match the signature or if variations of the lure are encountered; tuning the YARA rule, validating sender context, and sandboxing PDFs can help reduce noise. Consider augmenting with sender reputation checks and attachment filename/metadata constraints for stronger signal fidelity.