This rule targets inbound emails that carry PDF attachments and analyzes the embedded objects within those PDFs. It filters for attachments with file_type pdf, then expands/explodes the PDF to inspect its embedded objects. If any embedded object’s hash (pdf_obj_hash.object_hash) matches one of two known malicious hashes associated with credential-phishing PDFs, the rule triggers. The detection uses file analysis to inspect the PDF and threat intelligence to compare object hashes, classifying the finding under Malware/Ransomware with a PDF-centric technique. This approach helps identify cred-phish PDFs that rely on embedded objects to steal credentials. Limitations include reliance on known hashes (potential false negatives for new/obfuscated objects) and potential false positives if legitimate PDFs reuse similar embedded objects. Actionable outcomes include flagging or quarantining the email and initiating further investigation with updated hash indicators as new cred-phish PDFs are observed.