Sublime Core Feed | Sublime Security

Sublime Core Feed
Login to Sublime
Sublime Core FeedThis repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Sublime Security
Last updated Jul 25th, 2026
Feed Source
GitHub
Detection Method is
Rule Name & Severity
Last Updated
Attachment: Malicious zip file matching zipline campaign
Sublime Security
1mo ago
Jun 25th, 2026
Malware/Ransomware
LNK
Archive analysis
YARA
Content analysis
Threat intelligence
Malware/Ransomware
LNK
Archive analysis
YARA
Content analysis
Threat intelligence
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
Sublime Security
4mo ago
Mar 2nd, 2026
Malware/Ransomware
PDF
Evasion
File analysis
Threat intelligence
Malware/Ransomware
PDF
Evasion
File analysis
Threat intelligence
Body: Fake secure email portal with HTML obfuscation
Sublime Security
1mo ago
Jun 18th, 2026
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Brand impersonation: Government / Tax Authority document lure
Sublime Security
12d ago
Jul 14th, 2026
Credential Phishing
Impersonation: Brand
Free subdomain host
Social engineering
Lookalike domain
Sender analysis
URL analysis
Natural Language Understanding
Content analysis
Threat intelligence
Credential Phishing
Impersonation: Brand
Free subdomain host
Social engineering
Lookalike domain
Sender analysis
URL analysis
Natural Language Understanding
Content analysis
Threat intelligence
Brand impersonation: ukr[.]net
Sublime Security
3y ago
Aug 21st, 2023
Credential Phishing
Impersonation: Brand
Social engineering
Sender analysis
Threat intelligence
Credential Phishing
Impersonation: Brand
Social engineering
Sender analysis
Threat intelligence
Link: 9WOLF phishkit initial landing URI
Sublime Security
5mo ago
Jan 30th, 2026
Malware/Ransomware
Evasion
URL analysis
Threat intelligence
Malware/Ransomware
Evasion
URL analysis
Threat intelligence
Link: Free file host link with 'Important Viewing Note' lure
Sublime Security
11d ago
Jul 15th, 2026
Credential Phishing
Free file host
Social engineering
Impersonation: Brand
Content analysis
URL analysis
Threat intelligence
Credential Phishing
Free file host
Social engineering
Impersonation: Brand
Content analysis
URL analysis
Threat intelligence
Link: Google Cloud Storage redirect to external domain
Sublime Security
26d ago
Jun 30th, 2026
Credential Phishing
Spam
Malware/Ransomware
Free file host
Open redirect
Impersonation: Brand
Social engineering
Evasion
URL analysis
Threat intelligence
Credential Phishing
Spam
Malware/Ransomware
Free file host
Open redirect
Impersonation: Brand
Social engineering
Evasion
URL analysis
Threat intelligence
Link: Landing page with search-ms protocol redirect
Sublime Security
3mo ago
Apr 7th, 2026
Malware/Ransomware
Evasion
Scripting
URL analysis
Threat intelligence
Malware/Ransomware
Evasion
Scripting
URL analysis
Threat intelligence
Link: URL redirecting to blob URL
Sublime Security
5mo ago
Feb 24th, 2026
Credential Phishing
Malware/Ransomware
Evasion
Free file host
Open redirect
Sender analysis
URL analysis
Threat intelligence
Credential Phishing
Malware/Ransomware
Evasion
Free file host
Open redirect
Sender analysis
URL analysis
Threat intelligence
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)
Sublime Security
2mo ago
Apr 29th, 2026
Malware/Ransomware
Evasion
Archive analysis
File analysis
Sender analysis
Threat intelligence
Malware/Ransomware
Evasion
Archive analysis
File analysis
Sender analysis
Threat intelligence
MalwareBazaar: Malicious attachment hash (trusted reporters)
Sublime Security
4mo ago
Mar 26th, 2026
Malware/Ransomware
File analysis
Sender analysis
Threat intelligence
Malware/Ransomware
File analysis
Sender analysis
Threat intelligence
Malware: Pikabot delivery via URL auto-download
Sublime Security
2y ago
Apr 25th, 2024
Malware/Ransomware
Evasion
Archive analysis
File analysis
Threat intelligence
URL analysis
Malware/Ransomware
Evasion
Archive analysis
File analysis
Threat intelligence
URL analysis
Service abuse: Google OAuth with suspicious redirect destination
Sublime Security
1mo ago
May 27th, 2026
Credential Phishing
Evasion
Free file host
Free subdomain host
Open redirect
Social engineering
URL analysis
Threat intelligence
Credential Phishing
Evasion
Free file host
Free subdomain host
Open redirect
Social engineering
URL analysis
Threat intelligence
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)
Sublime Security
6mo ago
Jan 12th, 2026
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
15 Rules