Detects inbound email messages originating from free email providers that have an empty subject and empty body, and contain a Word document attachment (doc/docx). The attachment is scanned for embedded HYPERLINK field codes and valid URLs via HTML/XML analysis. If URLs are found, the document text is extracted and evaluated with an NLU classifier to identify intents related to credential theft or advance-fee fraud (credential phishing/BEC). The rule requires the message to not be a reply or forward, and to come from a free email domain, enforcing a social-engineering scenario where a malicious document is used to harvest credentials or defraud the recipient. Detection methods include file analysis, XML/HTML analysis, URL extraction, and natural language understanding, tied to the inbound path and the sender’s free-email domain. The rule flags conditions where a doc/docx attachment contains hyperlink URLs and the extracted text signals credential theft or advance-fee fraud with non-low confidence. Attack types captured are Credential Phishing and BEC/Fraud, with tactics focusing on Free email providers, Social engineering, and Evasion, and data sources centered on File content. This rule is designed to identify socially engineered documents attempting to exploit trust in free email channels while evading basic checks through empty subject/body fields.