This rule detects inbound emails that show signs of business email compromise (BEC) or credential theft intent and specifically targets Excel attachments used to exfiltrate or redirect to malicious URLs. It operates in two parallel checks. First, it uses natural language understanding (NLU) on the email body to identify intents named 'bec' or 'cred_theft' with a confidence level other than 'low', or the body text contains phrases such as 'your review' or 'please review' indicative of social engineering. Second, it evaluates attachments: if an attached file has an XLS extension, the rule (using a beta EXIF parsing capability) extracts metadata fields and looks for a Hyperlinks entry. Each hyperlink value is parsed as a URL and compared against threat intelligence lists: free subdomain hosts, free file hosts, suspicious TLDs, and URL shorteners, by matching domain.domain, domain.root_domain, or domain.tld to the respective lists. A match on any hyperlink triggers a detection. The rule is categorized under attack_types BEC/Fraud and Credential Phishing, with associated techniques including Free file host, Free subdomain host, and Social engineering, and employs detection_methods such as Natural Language Understanding, Content analysis, Exif analysis, File analysis, and URL analysis for comprehensive coverage.