This rule detects inbound email attachments (non-ICS) that embed a URL whose fragment contains the recipient’s email address encoded in hexadecimal. It targets attachments such as PDFs, Office docs, HTML, etc., by expanding the file (file.explode) and inspecting URLs within the content (file.scan.url.urls). If a URL fragment, when hex-decoded (strings.decode_hex(.fragment)), equals the first recipient’s email address (recipients.to[0].email.email), the rule triggers. The technique is used to personalize or track clicks on malicious links delivered via attachments rather than the message body, commonly in spoofed invoice or financial notices designed for credential phishing (BEC). ICS/calendar attachments are explicitly ignored. This detection leverages file content analysis, URL analysis, and general content analysis to identify targeted phishing payloads embedded in attachments.