Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Oct 23rd, 2026

Feed Source

GitHub

Tactic or Technique is

Rule Name & Severity	Author	Last Updated	Labels
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation	@ajpc500	9mo ago Jan 12th, 2026	Malware/Ransomware Macros Scripting Content analysis File analysis Macro analysis
Attachment: Malicious OneNote commands	@Kyle_Parrish_	9mo ago Jan 12th, 2026	Malware/Ransomware OneNote Scripting Archive analysis Content analysis File analysis YARA
Attachment: Microsoft impersonation via PDF with link and suspicious language	Sublime Security	1mo ago Sep 23rd, 2026	Credential Phishing Malware/Ransomware Image as content Impersonation: Brand PDF Scripting Social engineering Computer Vision File analysis Header analysis Natural Language Understanding Sender analysis
Attachment: Office document with VSTO add-in	@vector_sec	9mo ago Jan 12th, 2026	Malware/Ransomware Scripting Archive analysis Content analysis Exif analysis File analysis Sender analysis URL analysis
Attachment: Office file with suspicious function calls or downloaded file path	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Evasion Scripting Archive analysis File analysis
Attachment: PowerPoint with suspicious hyperlink	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Evasion Scripting Exif analysis File analysis
Attachment: PowerShell content	@ajpc500	1y ago Aug 5th, 2025	Malware/Ransomware Scripting Archive analysis File analysis
Attachment: SFX archive containing commands	Sublime Security	9mo ago Jan 12th, 2026	Malware/Ransomware Evasion Scripting File analysis
Attachment: SVG file execution	Sublime Security	1y ago Aug 8th, 2025	Malware/Ransomware Scripting Archive analysis Content analysis File analysis
Body: CVE-2026-42897 Exchange OWA stored XSS	Sublime Security	1mo ago Sep 9th, 2026	Malware/Ransomware Evasion Exploit Scripting Content analysis HTML analysis
ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction	Sublime Security	1mo ago Aug 26th, 2026	Malware/Ransomware Credential Phishing Evasion Social engineering Scripting Content analysis Natural Language Understanding Sender analysis URL analysis
Credential theft: JavaScript date manipulation in HTML body	Sublime Security	2mo ago Jul 28th, 2026	Credential Phishing Evasion Scripting Social engineering HTML analysis Javascript analysis Natural Language Understanding
CVE-2023-5631 - Roundcube Webmail XSS via crafted SVG	Sublime Security	6mo ago Apr 27th, 2026	Malware/Ransomware Evasion Exploit HTML smuggling Scripting Content analysis HTML analysis Sender analysis
HTML: Bidirectional (BIDI) HTML override with right to left obfuscation	Sublime Security	1mo ago Aug 31st, 2026	BEC/Fraud Credential Phishing Evasion Social engineering Scripting Content analysis HTML analysis
HTML smuggling containing recipient email address	Sublime Security	11mo ago Nov 4th, 2025	Credential Phishing Malware/Ransomware Evasion HTML smuggling Scripting Archive analysis File analysis Sender analysis
Link: Credential phishing with obfuscated JavaScript redirect	Sublime Security	2mo ago Aug 21st, 2026	Credential Phishing Open redirect Evasion Scripting Social engineering Natural Language Understanding URL analysis Javascript analysis
Link: Credential phishing with visit-tracking script	Sublime Security	30d ago Sep 25th, 2026	Credential Phishing Scripting Evasion Natural Language Understanding URL analysis HTML analysis Javascript analysis
Link: Cryptocurrency fraud with suspicious links	Sublime Security	10mo ago Dec 1st, 2025	BEC/Fraud Social engineering Evasion Free subdomain host Scripting Content analysis Header analysis Javascript analysis Natural Language Understanding Sender analysis URL analysis URL screenshot Whois
Link: JavaScript obfuscation with Telegram bot integration	Sublime Security	8mo ago Feb 25th, 2026	Credential Phishing Evasion Scripting Content analysis Javascript analysis URL analysis
Link: Landing page with search-ms protocol redirect	Sublime Security	6mo ago Apr 7th, 2026	Malware/Ransomware Evasion Scripting URL analysis Threat intelligence
Link: Suspicious recipient with timeout redirect	Sublime Security	2mo ago Aug 4th, 2026	Credential Phishing Scripting Evasion Social engineering URL analysis Javascript analysis HTML analysis Sender analysis
Link: Suspicious TLD hosting client.js with cf beacon	Sublime Security	1mo ago Sep 11th, 2026	Credential Phishing Social engineering Scripting URL analysis Content analysis Sender analysis
Mass campaign: Cross Site Scripting (XSS) attempt	Sublime Security	27d ago Sep 28th, 2026	Malware/Ransomware Spam Exploit Free email provider Scripting Social engineering Content analysis Header analysis Sender analysis
Suspected cross-site scripting (XSS) found in subject	Sublime Security	27d ago Sep 28th, 2026	Credential Phishing Evasion Scripting Content analysis Sender analysis
Suspected WordPress abuse with cross-site scripting (XSS) indicators	Sublime Security	1y ago Aug 5th, 2025	Malware/Ransomware Credential Phishing Scripting Impersonation: Brand Social engineering Content analysis Sender analysis

75 Rules

Page 2 of 2