Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Jul 25th, 2026
Feed Source
Tactic or Technique is
Rule Name & Severity
Author
Last Updated
Labels
Link: Recipient email address in 'eta' parameter
Sublime Security
6mo ago
Jan 27th, 2026
Link: Remittance payment request with timeline template
Sublime Security
1mo ago
Jun 4th, 2026
Link: RFI document reference pattern in display text
Sublime Security
3mo ago
Apr 1st, 2026
Link: Romance/Sexual Language With Suspicious Link
Sublime Security
1mo ago
Jun 17th, 2026
Link: ScreenConnect installer with suspicious relay domain
Sublime Security
6mo ago
Jan 12th, 2026
Link: ScreenConnect remote access tool delivery with unattended guest access
Sublime Security
5d ago
Jul 21st, 2026
Link: Scribd fullscreen link from suspicious sender
Sublime Security
11mo ago
Aug 5th, 2025
Link: Self-sender credential theft with configuration placeholder
Sublime Security
1mo ago
May 27th, 2026
Link: Self-sender with IP geolocation check and suspicious link behavior
Sublime Security
12d ago
Jul 14th, 2026
Link: Self-sender with sender org in subject and credential theft indicator
Sublime Security
6mo ago
Jan 12th, 2026
Link: Self-sent message with quarterly document review request
Sublime Security
30d ago
Jun 26th, 2026
Link: Self-sent PDF lure with subject correlation
Sublime Security
1mo ago
Jun 4th, 2026
Link: SharePoint filename matches org name
Sublime Security
5mo ago
Feb 6th, 2026
Link: Shortened URL with fragment matching subject
Sublime Security
3mo ago
Apr 9th, 2026
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Sublime Security
3mo ago
Apr 24th, 2026
Link: Squarespace infrastructure abuse
Sublime Security
11mo ago
Aug 5th, 2025
Link: Suspicious Family fragment parameter with encoded recipient data
Sublime Security
2mo ago
Apr 27th, 2026
Link: Suspicious file retrieval with recipient targeting
Sublime Security
1mo ago
Jun 12th, 2026
Link: Suspicious go.php redirect with document lure
Sublime Security
1mo ago
Jun 26th, 2026
Link: Suspicious Loom HTML file path
Sublime Security
2mo ago
May 6th, 2026
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Sublime Security
30d ago
Jun 26th, 2026
Link: Suspicious URL with recipient targeting and special characters
Sublime Security
5mo ago
Feb 21st, 2026
Link: Suspicious wp-admin path from mismatched sender domain
Sublime Security
9d ago
Jul 17th, 2026
Link: Tax document lure Portuguese/Spanish with suspicious domains
Sublime Security
3mo ago
Apr 14th, 2026
Link to auto-downloaded disk image in encrypted zip
@ajpc500
6mo ago
Jan 12th, 2026
Link to auto-downloaded DMG in encrypted zip
Sublime Security
1y ago
Jul 16th, 2025
Link to auto-downloaded file with Adobe branding
Sublime Security
1y ago
Jul 16th, 2025
Link to auto-downloaded file with Google Drive branding
Sublime Security
6mo ago
Jan 12th, 2026
Link to auto-download of a suspicious file type (unsolicited)
Sublime Security
6mo ago
Jan 12th, 2026
Link to Google Apps Script macro (unsolicited)
Sublime Security
6mo ago
Jan 12th, 2026
Link to Google Apps Script macro via comment tagging
Sublime Security
6mo ago
Jan 12th, 2026
Link: Uncommon SharePoint document type with sender's display name
Sublime Security
11mo ago
Aug 5th, 2025
Link: Unformatted template with literal placeholder in mailto link
Sublime Security
27d ago
Jun 29th, 2026
Link: Unsolicited email contains link leading to Tycoon URL structure
Sublime Security
4mo ago
Mar 10th, 2026
Link: Unsolicited email contains link to page containing Tycoon URI structure
Sublime Security
4mo ago
Mar 10th, 2026
Link: URL scheme obfuscation via split HTML anchors
Sublime Security
6mo ago
Jan 12th, 2026
Link: URL shortener with copy-paste instructions and credential theft language
Sublime Security
5mo ago
Feb 6th, 2026
Link: WordPress admin targeting with recipient identifier in URL parts
Sublime Security
27d ago
Jun 29th, 2026
Link: WordPress login page with Blogspot Binance scam
Sublime Security
5mo ago
Feb 17th, 2026
Lookalike sender domain (untrusted sender)
Sublime Security
4mo ago
Mar 25th, 2026
Low reputation link to auto-downloaded HTML file with smuggling indicators
Sublime Security
6mo ago
Jan 12th, 2026
macOS malware: Compiled AppleScript with document double-extension
Sublime Security
5mo ago
Feb 5th, 2026
Mass campaign: Cross Site Scripting (XSS) attempt
Sublime Security
1y ago
Jul 16th, 2025
Mass campaign: recipient address in subject, body, and link (untrusted sender)
Sublime Security
6mo ago
Jan 12th, 2026
Message content: Request for author engagement
Sublime Security
2d ago
Jul 24th, 2026
Microsoft device code phishing
@ajpc500
6mo ago
Jan 12th, 2026
Microsoft infrastructure abuse with suspicious patterns
Sublime Security
6mo ago
Jan 12th, 2026
Mismatched links: Free file share with urgent language
Sublime Security
11mo ago
Aug 5th, 2025
Newly registered sender or reply-to domain with newly registered linked domain
Sublime Security
11mo ago
Aug 5th, 2025
Non-RFC compliant calendar files from unsolicited sender
Sublime Security
2mo ago
Apr 28th, 2026