Detects inbound emails that impersonate the U.S. Securities and Exchange Commission (SEC) by correlating sender identity signals, body content, and URL indicators. The rule flags messages where: (1) the sender display name matches SEC-like patterns (e.g., sec.gov, SEC-related phrases, or terms such as securities and exchange commission) or an NLU entity labeled as the sender indicates an SEC reference; (2) the body contains SEC-related language in combination with links to lookalike domains mimicking sec.gov; or (3) the body or sender text references SEC terms (e.g., “u.s. securities” or “sec.gov”) and any embedded links point to domains that resemble sec.gov but are not sec.gov (including lookalike domains in the domain or subdomain space). The rule applies additional checks to identify lookalike domains using domain-level patterns and subdomain variants (e.g., secgov lookalikes) while discounting messages from high-trust senders if DMARC passes. It excludes messages classified as Newsletters or Current Events to reduce false positives and allows legitimate high-trust domains (or govdelivery.com) with DMARC pass to pass without alert. The detection logic combines sender analysis, content analysis, URL/domain analysis, natural language understanding, and header context to identify impersonation, spoofing, lookalike domains, and social engineering. Detected attack types include BEC/Fraud and Credential Phishing. The rule is designed to surface suspicious SEC impersonation attempts while minimizing false positives from trusted or legitimate newsletters and compliant domains.