This rule detects inbound messages that include a PDF attachment matching a YARA signature named pdf_fake_linkedIn_invoice_lure. It triggers when an inbound message has at least one attachment with file_type pdf and the file, upon file expansion and analysis, matches the YARA signature pdf_fake_linkedIn_invoice_lure. The rule is designed to identify fake LinkedIn invoice lures used in business email compromise and credential phishing campaigns, leveraging social engineering and brand impersonation (LinkedIn) via a PDF invoice. Detection relies on YARA-based file analysis of attachments. Severity is set to medium, aligned with BEC/Fraud and Credential Phishing tactics. Techniques include Impersonation: Brand, PDF usage, and Social engineering.