Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Oct 23rd, 2026
Feed Source
Detection Method is
Rule Name & Severity
Author
Last Updated
Labels
VIP impersonation: Fabricated thread history with fake VIP recipients
Sublime Security
3mo ago
Jul 8th, 2026
VIP impersonation: Fake thread with display name match, email mismatch
Sublime Security
6mo ago
Apr 3rd, 2026
VIP impersonation: Fake thread with name-in-brackets header artifact
Sublime Security
4d ago
Oct 21st, 2026
VIP impersonation: Fake thread with VIPs missing email metadata
Sublime Security
2mo ago
Aug 11th, 2026
VIP impersonation: Payment handoff with VIP display name authored fake threads
Sublime Security
4d ago
Oct 21st, 2026
VIP Impersonation via Google Group relay with suspicious indicators
Sublime Security
2mo ago
Aug 5th, 2026
VIP Impersonation: VIP handoff with fake forwarded invoice thread
Sublime Security
2mo ago
Aug 17th, 2026
VIP impersonation: VIP name within a delimited subject with fake previous threads
Sublime Security
9d ago
Oct 16th, 2026
VIP impersonation: VIP payment redirect handoff via fake threads
Sublime Security
4d ago
Oct 21st, 2026
VIP impersonation with charitable donation fraud
Sublime Security
4mo ago
Jun 5th, 2026
VIP impersonation with invoicing request
Sublime Security
1mo ago
Sep 23rd, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
7mo ago
Mar 12th, 2026
VIP local_part impersonation from unsolicited sender
Sublime Security
1mo ago
Sep 23rd, 2026
Xero infrastructure abuse
Sublime Security
11mo ago
Nov 3rd, 2025
X (Twitter) impersonation with credential phishing motives
Sublime Security
5mo ago
May 15th, 2026
Zoom Events newsletter abuse
Sublime Security
3mo ago
Jul 8th, 2026