This rule detects inbound messages that carry a PDF attachment which matches a specific YARA signature named pdf_quickbooks_toad_lure_blank_page. When an inbound message is processed, the rule filters for attachments with file_type == pdf and runs a YARA scan on the PDF content. If the scan yields a match with the signature pdf_quickbooks_toad_lure_blank_page, a detection is raised for a potential QuickBooks-themed callback phishing lure. The rule is categorized under Callback Phishing and uses detection methods including file analysis and YARA. Tactics and techniques include PDF usage, impersonation of a brand (QuickBooks), and social engineering. This approach helps surface targeted phishing attempts that attempt to lure users into initiating actions that appear to originate from QuickBooks. Potential limitations include dependence on the specific YARA signature (which may miss novel variants), possible false positives with PDFs containing similar patterns, and performance considerations due to YARA scanning on inbound traffic. Operators should keep the signature up to date and consider corroborating with sandbox analysis or additional IOC checks for stronger risk assessment.