Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Oct 23rd, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Attachment: RTF with embedded content	@amitchell516	2y ago Feb 26th, 2024	Malware/Ransomware Evasion File analysis YARA
Attachment: WinRAR CVE-2025-8088 exploitation	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
Attachment with unscannable encrypted zip	Sublime Security	5mo ago Apr 30th, 2026	Malware/Ransomware Encryption Evasion Archive analysis File analysis YARA
Attachment: ZIP containing Office binary with embedded DLL	Sublime Security	2mo ago Aug 24th, 2026	Malware/Ransomware Evasion Archive analysis File analysis YARA
Attachment: ZIP filename mismatch	Sublime Security	1mo ago Aug 31st, 2026	Malware/Ransomware Evasion Archive analysis YARA File analysis
Attachment: ZIP file with CVE-2026-0866 exploit	Sublime Security	7mo ago Mar 20th, 2026	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
Encrypted Microsoft Office files from untrusted sender	Sublime Security	25d ago Sep 28th, 2026	BEC/Fraud Callback Phishing Credential Phishing Extortion Malware/Ransomware Spam Encryption Evasion File analysis YARA Sender analysis
Link to auto-downloaded disk image in encrypted zip	@ajpc500	9mo ago Jan 12th, 2026	Malware/Ransomware Encryption Evasion Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
Link to auto-downloaded DMG in encrypted zip	Sublime Security	30d ago Sep 23rd, 2026	Malware/Ransomware Encryption Evasion Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
Link to auto-download of a suspicious file type (unsolicited)	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Encryption Evasion LNK Social engineering Archive analysis File analysis Sender analysis URL analysis YARA

60 Rules

Page 2 of 2