Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Sep 30th, 2026

Feed Source

GitHub

Tactic or Technique is

Rule Name & Severity	Author	Last Updated	Labels
HTML content with print styling and credential theft language	Sublime Security	3mo ago Jun 16th, 2026	Credential Phishing Evasion HTML smuggling Social engineering Content analysis HTML analysis Natural Language Understanding
HTML smuggling containing recipient email address	Sublime Security	11mo ago Nov 4th, 2025	Credential Phishing Malware/Ransomware Evasion HTML smuggling Scripting Archive analysis File analysis Sender analysis
HTML smuggling with atob in message body	Sublime Security	8mo ago Jan 12th, 2026	Credential Phishing Malware/Ransomware HTML smuggling Content analysis HTML analysis
Low reputation link to auto-downloaded HTML file with smuggling indicators	Sublime Security	2mo ago Jul 29th, 2026	Credential Phishing Evasion Free file host Free subdomain host HTML smuggling Impersonation: Brand Open redirect Social engineering Content analysis File analysis HTML analysis Javascript analysis Sender analysis URL analysis

54 Rules

Page 2 of 2