Sublime Core Feed | Sublime Security

Sublime Core Feed
Login to Sublime
Sublime Core FeedThis repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Sublime Security
Last updated Jan 23rd, 2026
Feed Source
GitHub
Detection Method is
Rule Name & Severity
Last Updated
Attachment: Archive contains DLL-loading macro
Sublime Security
3y ago
Dec 28th, 2023
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
/feeds/core/detection-rules/attachment-archive-contains-dll-loading-macro-3a193f5f
Attachment: Archive with embedded EXE file
Sublime Security
2y ago
Feb 27th, 2024
Malware/Ransomware
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Evasion
Archive analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-archive-with-embedded-exe-file-e2b0ad86
Attachment: DocX embedded binary
Sublime Security
5mo ago
Aug 5th, 2025
Malware/Ransomware
Evasion
Archive analysis
Content analysis
YARA
Malware/Ransomware
Evasion
Archive analysis
Content analysis
YARA
/feeds/core/detection-rules/attachment-docx-embedded-binary-feff0241
Attachment: EML with Encrypted ZIP
Sublime Security
11d ago
Jan 12th, 2026
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-eml-with-encrypted-zip-6897a8f7
Attachment: HTML file with excessive padding and suspicious patterns
Sublime Security
11d ago
Jan 12th, 2026
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
File analysis
HTML analysis
YARA
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
File analysis
HTML analysis
YARA
/feeds/core/detection-rules/attachment-html-file-with-excessive-padding-and-suspicious-patterns-0a6aee1e
Attachment: HTML file with reference to recipient and suspicious patterns
Sublime Security
11d ago
Jan 12th, 2026
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
/feeds/core/detection-rules/attachment-html-file-with-reference-to-recipient-and-suspicious-patterns-5333493d
Attachment: HTML smuggling with embedded base64-encoded executable
Sublime Security
2y ago
Mar 25th, 2024
Malware/Ransomware
Evasion
HTML smuggling
Archive analysis
File analysis
HTML analysis
YARA
Malware/Ransomware
Evasion
HTML smuggling
Archive analysis
File analysis
HTML analysis
YARA
/feeds/core/detection-rules/attachment-html-smuggling-with-embedded-base64-encoded-executable-b00c4527
Attachment: JavaScript file with suspicious base64-encoded executable
Sublime Security
2y ago
Apr 1st, 2024
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
YARA
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-javascript-file-with-suspicious-base64-encoded-executable-b8db0cf3
Attachment: Malformed OLE file
Sublime Security
2y ago
Nov 25th, 2024
Credential Phishing
Malware/Ransomware
Evasion
File analysis
YARA
Credential Phishing
Malware/Ransomware
Evasion
File analysis
YARA
/feeds/core/detection-rules/attachment-malformed-ole-file-5aadc68f
Attachment: Malicious OneNote commands
@Kyle_Parrish_
11d ago
Jan 12th, 2026
Malware/Ransomware
OneNote
Scripting
Archive analysis
Content analysis
File analysis
YARA
Malware/Ransomware
OneNote
Scripting
Archive analysis
Content analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-malicious-onenote-commands-7319f0eb
Attachment: Password-protected PDF with fake document indicators
Sublime Security
2d ago
Jan 21st, 2026
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Attachment: RTF with embedded content
@amitchell516
2y ago
Feb 26th, 2024
Malware/Ransomware
Evasion
File analysis
YARA
Malware/Ransomware
Evasion
File analysis
YARA
/feeds/core/detection-rules/attachment-rtf-with-embedded-content-61dd2dd7
Attachment: WinRAR CVE-2025-8088 exploitation
Sublime Security
11d ago
Jan 12th, 2026
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-winrar-cve-2025-8088-exploitation-33b3a82b
Attachment with unscannable encrypted zip (unsolicited)
Sublime Security
6mo ago
Jul 16th, 2025
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
Sender analysis
YARA
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
Sender analysis
YARA
/feeds/core/detection-rules/attachment-with-unscannable-encrypted-zip-unsolicited-529d4a9a
Encrypted Microsoft Office files from untrusted sender
Sublime Security
5mo ago
Aug 5th, 2025
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Spam
Encryption
Evasion
File analysis
YARA
Sender analysis
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Spam
Encryption
Evasion
File analysis
YARA
Sender analysis
/feeds/core/detection-rules/encrypted-microsoft-office-files-from-untrusted-sender-eb7b26e7
Link to auto-downloaded disk image in encrypted zip
11d ago
Jan 12th, 2026
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
/feeds/core/detection-rules/link-to-auto-downloaded-disk-image-in-encrypted-zip-b50f0cb1
Link to auto-downloaded DMG in encrypted zip
Sublime Security
6mo ago
Jul 16th, 2025
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
/feeds/core/detection-rules/link-to-auto-downloaded-dmg-in-encrypted-zip-43af98d3
Link to auto-download of a suspicious file type (unsolicited)
Sublime Security
11d ago
Jan 12th, 2026
Malware/Ransomware
Encryption
Evasion
LNK
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
LNK
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
/feeds/core/detection-rules/link-to-auto-download-of-a-suspicious-file-type-unsolicited-67ae2152
18 Rules