Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Oct 23rd, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Link to auto-download of a suspicious file type (unsolicited)	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Encryption Evasion LNK Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)	Sublime Security	5mo ago Apr 29th, 2026	Malware/Ransomware Evasion Archive analysis File analysis Sender analysis Threat intelligence
Malware: Pikabot delivery via URL auto-download	Sublime Security	1mo ago Sep 23rd, 2026	Malware/Ransomware Evasion Archive analysis File analysis Threat intelligence URL analysis
Non-RFC compliant calendar files from unsolicited sender	Sublime Security	5mo ago Apr 28th, 2026	Evasion ICS Phishing Social engineering Archive analysis Content analysis File analysis Sender analysis
QR code to auto-download of a suspicious file type (unsolicited)	Sublime Security	1mo ago Sep 23rd, 2026	Malware/Ransomware Evasion LNK Social engineering Archive analysis File analysis Sender analysis URL analysis QR code analysis

105 Rules

Page 3 of 3