This rule detects abuse of legitimate Filemail file-sharing notification emails to deliver malicious payloads. It triggers on inbound mail from no-reply@filemail.com and looks for two patterns: (1) a reply-to address whose domain is different from filemail.com and whose local-part appears randomized/alphanumeric (regex: [a-z]{3,}\d{3,6}); or (2) notification body content referencing financial lures such as invoices, quotations, remittance statements, or purchase orders, identified via HTML parsing and keyword matching (invoice, invoices, estimate(s), remittance, statement(s), purchase order, proforma, billing, payment, receipt, quotation, ACH, wire transfer). This combination indicates the free Filemail service being leveraged to distribute malicious payloads while evading detection through trusted infrastructure. Attack types include Malware/Ransomware and BEC/Fraud. Detected techniques include using a Free file host, social engineering, and spoofing. Detection methods comprise header analysis, HTML/content analysis, and targeted content inspection. The rule aims to protect against credential/phishing campaigns and malware delivered via deceptive file-sharing notifications, typically relevant for inbound email gateways and endpoint security contexts that process email traffic.