Anyone have a rule to detect "Dear xxx" in the body of the message where the "To:" address is xxx@domain?

Does anyone have a rule to detect "Dear xxx," in the body of the 
message, where the "To:" address is xxx@domain?

We've been getting phishing email sent to us with variations of that. 
Hi, Dear, etc, followed by the username of the address.

Thanks. - Mark