sentry

click_tracking

disable_posthog_tracking

suborganization_creation

microsoft_non_admin_onboarding_bypass_tenant_verification

hide_hip_progress_bar

expose_inline_message_meta

safelinks_click_tracking

show_enable_inline_processing

ms365_cert_based_auth

mdv_redirect_original_canonical_id_to_cluster_id

ignore_asr_priority_counts

self_serve_fix_gmail_reports

inline_webhook_alerts

force_disable_all_frontend_slurp_restrictions

onboarding_abuse_mailbox_route

mdv_asa_button_all_messages

asa_full_response

disable_mailboxes_ui

oletools_output_ui

stratum_mlvs

threat_log_passive_mode

ade_internal_button

export_search_emls_limit

graymail_action

quantum_hunts_ui

enable_asa_in_mlv

share_with_ts_action_id

ts_redirect_base_url

dlp_beta_ui

delete_calendar_events_action

search_v1_url

grandchild_org_creation

dlp_ga_ui

agentic_products_enabled

feeds_https_auth

message_groups_rule_type_filter

vendor_management_ui

dlp_rules_ui

dlp_public_beta_ui

phishing_sim_ui

pdf_exports_mvp

can_access_child_orgs_permission

auth_default_no_child_org_access

internal_only_mlv_ui

hunt_job_status_polling_interval_config

disable_ade_for_internal_only

attack_insights_internal_mode

disposition_in_mlv

inline_ga_ui

inline_delivery_next_hop_ui

overview_v2_graymail_classification

terms_and_conditions_checkbox_clickwrap_id

labs_quantum_hunts

remove_large_text_fields_from_mdm_ui

graymail_user_preference_ui

trusted_sender_ip_ui

ade_webhook_ui

quarantine_digest_beta

vault_color_refresh

inline_ui

blocklisted_senders_ui

remove_full_key_display

xl_groups_reduced_mlv_ui

classification_unification_ui

phishing_sims_private_beta_ui

stratum_mlvs_v2

xl_groups_activity_endpoint_ui

asa_summary_in_user_report_results

inline_dlp_settings_v2

allow_long_message_metadata_retention

message_metadata_retention_banner

message_metadata_retention_setting

enforce_strict_wcag_contrast

Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

attack_type

tactic_or_technique

detection_method

Attachment: PDF Object Hash associated with a fake invoice and a W-9

Attachment: PDF Object Hash associated with fake Canada Revenue Agency documents

Rule Name & Severity	Author	Last Updated	Labels
Attachment: PDF Object Hash associated with a fake invoice and a W-9	Sublime Security	1mo ago Jul 2nd, 2026	BEC/Fraud PDF Evasion File analysis Threat Intelligence
Attachment: PDF Object Hash associated with fake Canada Revenue Agency documents	Sublime Security	1mo ago Jun 17th, 2026	Credential Phishing Malware/Ransomware PDF Evasion File analysis Threat Intelligence