This inbound-detection rule flags messages that include a PDF attachment which contains content that matches a specific YARA signature named pdf_gcpay_blurred_check. The condition looks for at least one attachment with file_type == "pdf" and then iterates the file’s internal structure (file.explode(.)) to evaluate YARA scans (scan.yara.matches) for a match with the signature name pdf_gcpay_blurred_check. The intent is to detect GCPay-related phishing documents that use blurred check images as a social-engineering lure to facilitate BEC/fraud. Detected events are categorized with medium severity, reflecting the financial risk posed by such phishing attempts. Detection methods rely on File analysis and YARA-based content scanning, combining attachment-level inspection with signature-based content identification. The rule design targets the combination of inbound messaging and PDF-laden content crafted for fraud, specifically images embedded within PDFs used to simulate payment-related documents. Potential false positives can arise if legitimate PDFs legitimately trigger the same YARA signature, so contextual SOC review and corroborating indicators are recommended. Remediation actions typically include quarantine or sandboxing of the attachment, alerting security personnel, and further validation of the sender and content before user exposure."