Sublime Core Feed | Sublime Security

Sublime Core Feed
Login to Sublime
Sublime Core FeedThis repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Sublime Security
Last updated Apr 21st, 2026
Feed Source
GitHub
Detection Method is
Rule Name & Severity
Last Updated
Attachment: Archive contains DLL-loading macro
Sublime Security
3y ago
Dec 28th, 2023
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Exploit
Macros
Scripting
Archive analysis
Content analysis
File analysis
Macro analysis
OLE analysis
Malware/Ransomware
Exploit
Macros
Scripting
Archive analysis
Content analysis
File analysis
Macro analysis
OLE analysis
Attachment: Excel file with document sharing lure created by Go Excelize
Sublime Security
2mo ago
Jan 29th, 2026
Credential Phishing
Macros
Social engineering
File analysis
Macro analysis
Content analysis
Exif analysis
Credential Phishing
Macros
Social engineering
File analysis
Macro analysis
Content analysis
Exif analysis
Attachment: Macro files containing MHT content
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Credential Phishing
Evasion
Macros
Scripting
Archive analysis
File analysis
Macro analysis
Malware/Ransomware
Credential Phishing
Evasion
Macros
Scripting
Archive analysis
File analysis
Macro analysis
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
Scripting
Content analysis
File analysis
Macro analysis
Malware/Ransomware
Macros
Scripting
Content analysis
File analysis
Macro analysis
Attachment: Office file with document sharing and browser instruction lures
Sublime Security
2mo ago
Jan 29th, 2026
Credential Phishing
Social engineering
Evasion
Archive analysis
File analysis
Macro analysis
Optical Character Recognition
Content analysis
Credential Phishing
Social engineering
Evasion
Archive analysis
File analysis
Macro analysis
Optical Character Recognition
Content analysis
Attachment: Potential sandbox evasion in Office file
3mo ago
Jan 12th, 2026
Malware/Ransomware
Evasion
Macros
File analysis
Macro analysis
Malware/Ransomware
Evasion
Macros
File analysis
Macro analysis
Attachment soliciting user to enable macros
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Optical Character Recognition
Sender analysis
Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Optical Character Recognition
Sender analysis
Attachment with auto-executing macro (unsolicited)
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
Archive analysis
Header analysis
File analysis
Macro analysis
OLE analysis
Sender analysis
Malware/Ransomware
Macros
Archive analysis
Header analysis
File analysis
Macro analysis
OLE analysis
Sender analysis
Attachment with auto-opening VBA macro (unsolicited)
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Sender analysis
Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Sender analysis
Attachment with high risk VBA macro (unsolicited)
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
File analysis
Macro analysis
OLE analysis
Sender analysis
Malware/Ransomware
Macros
File analysis
Macro analysis
OLE analysis
Sender analysis
Attachment with VBA macros from employee impersonation (unsolicited)
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Impersonation: Employee
Macros
Social engineering
Archive analysis
File analysis
Macro analysis
Sender analysis
Malware/Ransomware
Impersonation: Employee
Macros
Social engineering
Archive analysis
File analysis
Macro analysis
Sender analysis
Suspicious VBA macros from untrusted sender
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Macros
File analysis
Macro analysis
Sender analysis
Malware/Ransomware
Macros
File analysis
Macro analysis
Sender analysis
13 Rules