Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Mar 9th, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Xero infrastructure abuse	Sublime Security	4mo ago Nov 3rd, 2025	Credential Phishing Evasion Social engineering Content analysis Header analysis Natural Language Understanding URL analysis	/feeds/core/detection-rules/xero-infrastructure-abuse-918c4bd3
Xero invoice abuse	Sublime Security	2mo ago Dec 17th, 2025	BEC/Fraud Credential Phishing Impersonation: Brand Impersonation: Employee Social engineering Natural Language Understanding Content analysis Sender analysis	/feeds/core/detection-rules/xero-invoice-abuse-6538c600
X (Twitter) impersonation with credential phishing motives	Sublime Security	7mo ago Aug 5th, 2025	Credential Phishing Impersonation: Brand Social engineering Computer Vision File analysis Header analysis Optical Character Recognition Natural Language Understanding Sender analysis	/feeds/core/detection-rules/x-twitter-impersonation-with-credential-phishing-motives-0b60dca6
Zoom Events newsletter abuse	Sublime Security	1mo ago Jan 12th, 2026	Credential Phishing Free file host Free subdomain host Social engineering Impersonation: Brand Header analysis HTML analysis Natural Language Understanding URL analysis	/feeds/core/detection-rules/zoom-events-newsletter-abuse-c8fce846

204 Rules

Page 5 of 5