Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Oct 23rd, 2026
Feed Source
Detection Method is
Rule Name & Severity
Author
Last Updated
Labels
VIP impersonation: Payment handoff with VIP display name authored fake threads
Sublime Security
4d ago
Oct 21st, 2026
VIP Impersonation via Google Group relay with suspicious indicators
Sublime Security
2mo ago
Aug 5th, 2026
VIP impersonation: VIP payment redirect handoff via fake threads
Sublime Security
4d ago
Oct 21st, 2026
VIP impersonation with BEC language (near match, untrusted sender)
Sublime Security
1mo ago
Sep 23rd, 2026
VIP impersonation with charitable donation fraud
Sublime Security
4mo ago
Jun 5th, 2026
VIP impersonation with invoicing request
Sublime Security
1mo ago
Sep 23rd, 2026
VIP impersonation with urgent request (strict match, untrusted sender)
Sublime Security
1mo ago
Sep 23rd, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
7mo ago
Mar 12th, 2026
Xero infrastructure abuse
Sublime Security
11mo ago
Nov 3rd, 2025
Xero invoice abuse
Sublime Security
10mo ago
Dec 17th, 2025
X (Twitter) impersonation with credential phishing motives
Sublime Security
5mo ago
May 15th, 2026
Zoom Events newsletter abuse
Sublime Security
3mo ago
Jul 8th, 2026