Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Jul 25th, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Attachment: QR code with userinfo portion	Sublime Security	2mo ago Apr 30th, 2026	Credential Phishing Malware/Ransomware Evasion Image as content PDF QR code QR code analysis File analysis Sender analysis
Attachment: RDP connection file	@ajpc500	11mo ago Aug 5th, 2025	Malware/Ransomware Credential Phishing Archive analysis File analysis
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender	Sublime Security	8mo ago Nov 4th, 2025	Credential Phishing Evasion Social engineering File analysis Header analysis Natural Language Understanding Sender analysis
Attachment: RFP/RFQ impersonating government entities	Sublime Security	2y ago Jan 30th, 2024	BEC/Fraud Impersonation: Brand PDF Social engineering Content analysis File analysis Natural Language Understanding Optical Character Recognition Sender analysis
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators	Sublime Security	25d ago Jul 1st, 2026	BEC/Fraud Spam Social engineering Image as content Free email provider Free file host Out of band pivot Natural Language Understanding Header analysis Sender analysis Content analysis URL analysis File analysis
Attachment: RTF file with suspicious link	Sublime Security	1y ago Jul 23rd, 2025	Credential Phishing Evasion Archive analysis File analysis Sender analysis URL analysis
Attachment: RTF with embedded content	@amitchell516	2y ago Feb 26th, 2024	Malware/Ransomware Evasion File analysis YARA
Attachment: Self-sender PDF with minimal content and view prompt	Sublime Security	5mo ago Feb 12th, 2026	Credential Phishing Malware/Ransomware PDF Social engineering Evasion Content analysis File analysis Sender analysis
Attachment: SFX archive containing commands	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Evasion Scripting File analysis
Attachment: Single-page PDF with S3-hosted HTML link	Sublime Security	10d ago Jul 16th, 2026	Credential Phishing PDF Free file host Evasion File analysis Exif analysis URL analysis
Attachment: Small text file with link containing recipient email address	Sublime Security	2mo ago May 14th, 2026	Credential Phishing Evasion Social engineering File analysis URL analysis
Attachment: Soda PDF producer with encryption themes	Sublime Security	11mo ago Aug 5th, 2025	Credential Phishing PDF Social engineering File analysis Optical Character Recognition
Attachment soliciting user to enable macros	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Macros Archive analysis File analysis Macro analysis Optical Character Recognition Sender analysis
Attachment: Suspicious employee policy update document lure	Sublime Security	7mo ago Dec 26th, 2025	Credential Phishing PDF Social engineering Evasion Content analysis File analysis Sender analysis
Attachment: Suspicious PDF created with headless browser	Sublime Security	25d ago Jul 1st, 2026	Credential Phishing Evasion PDF Content analysis Exif analysis File analysis Optical Character Recognition
Attachment: SVG file execution	Sublime Security	11mo ago Aug 8th, 2025	Malware/Ransomware Scripting Archive analysis Content analysis File analysis
Attachment: SVG files with evasion elements	Sublime Security	2mo ago May 8th, 2026	Malware/Ransomware Credential Phishing QR code Image as content Evasion File analysis XML analysis QR code analysis Sender analysis
Attachment: SVG file with HTML entity encoded href attributes	Sublime Security	2mo ago May 20th, 2026	Malware/Ransomware Credential Phishing Evasion HTML smuggling File analysis Content analysis
Attachment: SVG file with hyperlinks and cursor styling	Sublime Security	2mo ago May 20th, 2026	Credential Phishing Evasion Image as content File analysis XML analysis Content analysis
Attachment: TAR file with RAR type	Sublime Security	3mo ago Apr 24th, 2026	Malware/Ransomware Evasion Archive analysis File analysis
Attachment: Uncommon compressed file	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Credential Phishing Archive analysis File analysis
Attachment: USDA bid invitation impersonation	Sublime Security	11mo ago Aug 5th, 2025	BEC/Fraud Impersonation: Brand PDF Macros Social engineering Content analysis File analysis Header analysis Natural Language Understanding Optical Character Recognition Sender analysis
Attachment: Web files with suspicious comments	Sublime Security	11mo ago Aug 8th, 2025	Credential Phishing Malware/Ransomware HTML smuggling Evasion File analysis HTML analysis Content analysis
Attachment: WinRAR CVE-2025-8088 exploitation	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
Attachment with auto-executing macro (unsolicited)	Sublime Security	1mo ago Jun 5th, 2026	Malware/Ransomware Macros Archive analysis Header analysis File analysis Macro analysis OLE analysis Sender analysis
Attachment with auto-opening VBA macro (unsolicited)	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Macros Archive analysis File analysis Macro analysis Sender analysis
Attachment with encrypted zip (unsolicited)	Sublime Security	1y ago Jul 16th, 2025	Malware/Ransomware Evasion Encryption Archive analysis File analysis Sender analysis
Attachment with high risk VBA macro (unsolicited)	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Macros File analysis Macro analysis OLE analysis Sender analysis
Attachment with macro calling executable	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Evasion Macros Archive analysis File analysis
Attachment with suspicious author (unsolicited)	Sublime Security	1y ago Jul 16th, 2025	Malware/Ransomware File analysis Sender analysis
Attachment with unscannable encrypted zip	Sublime Security	2mo ago Apr 30th, 2026	Malware/Ransomware Encryption Evasion Archive analysis File analysis YARA
Attachment with VBA macros from employee impersonation (unsolicited)	Sublime Security	6mo ago Jan 12th, 2026	Malware/Ransomware Impersonation: Employee Macros Social engineering Archive analysis File analysis Macro analysis Sender analysis
Attachment: XLSX file with suspicious print titles metadata	Sublime Security	10mo ago Sep 16th, 2025	Credential Phishing Evasion Macros File analysis Exif analysis
Attachment: ZIP file with CVE-2026-0866 exploit	Sublime Security	4mo ago Mar 20th, 2026	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail	Sublime Security	1mo ago Jun 5th, 2026	BEC/Fraud Free email provider Out of band pivot Content analysis File analysis Natural Language Understanding
Brand impersonation: Adobe Acrobat Sign PDF phishing file format template	Sublime Security	1mo ago Jun 1st, 2026	Credential Phishing Impersonation: Brand PDF Computer Vision Optical Character Recognition File analysis
Brand impersonation: Amazon with suspicious attachment	Sublime Security	3mo ago Apr 14th, 2026	Credential Phishing Impersonation: Brand Social engineering Computer Vision File analysis Header analysis Natural Language Understanding Optical Character Recognition Sender analysis
Brand impersonation: Chase bank with credential phishing indicators	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Impersonation: Brand Social engineering Computer Vision File analysis Natural Language Understanding Sender analysis URL analysis
Brand impersonation: Coinbase with suspicious links	Sublime Security	10mo ago Sep 22nd, 2025	Credential Phishing Evasion Free subdomain host Image as content Impersonation: Brand Computer Vision Content analysis File analysis URL analysis
Brand impersonation: DocuSign PDF attachment with suspicious link	Sublime Security	9mo ago Oct 22nd, 2025	Credential Phishing Impersonation: Brand PDF Social engineering File analysis Natural Language Understanding Optical Character Recognition URL analysis
Brand impersonation: Dropbox	Sublime Security	30d ago Jun 26th, 2026	Credential Phishing Impersonation: Brand Social engineering Content analysis File analysis Header analysis Sender analysis
Brand impersonation: Fake procurement/RFQ PDF from energy and industrial companies	Sublime Security	1mo ago Jun 25th, 2026	BEC/Fraud Impersonation: Brand PDF Social engineering Image as content Optical Character Recognition File analysis Content analysis
Brand impersonation: Google fake sign-in warning	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Impersonation: Brand Social engineering Computer Vision File analysis Optical Character Recognition Sender analysis URL analysis
Brand impersonation: Microsoft fake sign-in alert	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Header analysis Sender analysis Whois
Brand impersonation: Microsoft quarantine release notification in body	Sublime Security	1y ago Jul 16th, 2025	Credential Phishing Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Sender analysis
Brand impersonation: Microsoft quarantine release notification in image attachment	Sublime Security	1y ago Jul 16th, 2025	Credential Phishing Free file host Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Header analysis Natural Language Understanding Optical Character Recognition Sender analysis
Brand impersonation: Microsoft Teams	Sublime Security	2y ago Dec 3rd, 2024	Credential Phishing Impersonation: Brand Social engineering Content analysis File analysis Optical Character Recognition Sender analysis
Brand impersonation: Microsoft with low reputation links	Sublime Security	1mo ago Jun 5th, 2026	Credential Phishing Free file host Image as content Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Header analysis Natural Language Understanding Optical Character Recognition Sender analysis URL analysis
Brand impersonation: Norton	Sublime Security	6mo ago Jan 12th, 2026	Credential Phishing Free email provider Impersonation: Brand Social engineering Content analysis File analysis Header analysis Sender analysis
Brand Impersonation: PayPal	Sublime Security	9d ago Jul 17th, 2026	Credential Phishing Impersonation: Brand Lookalike domain Social engineering Computer Vision Content analysis File analysis Header analysis Sender analysis

305 Rules

Page 5 of 7