Technical summary: This detection rule flags inbound messages that include PDF attachments whose internal PDF object hash matches the known hash 859af9926b356dd9b9df3b2c59a7bd16, a hash associated with callback phishing lures. The rule scopes to inbound content, targets attachments by filtering for pdf file_type, and expands files to access the PDF’s internal properties (scan.pdf_obj_hash.object_hash). A match triggers a File analysis-based alert for Callback Phishing using the specified object hash signature. This is a signature-based defense relying on up-to-date hash catalogs; effectiveness depends on the hash registry’s completeness. It helps identify phishing payloads attempting to prompt callbacks or further interaction from the user by distributing PDFs with known malicious object hashes.