Sublime Core Feed | Sublime Security

Sublime Core Feed
Login to Sublime
Sublime Core FeedThis repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Sublime Security
Last updated Apr 21st, 2026
Feed Source
GitHub
Tactic or Technique is
Rule Name & Severity
Last Updated
Anthropic Magic String in HTML
Sublime Security
2mo ago
Feb 9th, 2026
Malware/Ransomware
Exploit
Content analysis
Malware/Ransomware
Exploit
Content analysis
Attachment: Archive containing HTML file with file scheme link
Sublime Security
1mo ago
Mar 17th, 2026
Credential Phishing
Evasion
Exploit
HTML smuggling
Social engineering
Archive analysis
File analysis
HTML analysis
Credential Phishing
Evasion
Exploit
HTML smuggling
Social engineering
Archive analysis
File analysis
HTML analysis
Attachment: Archive contains DLL-loading macro
Sublime Security
3y ago
Dec 28th, 2023
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
Malware/Ransomware
Exploit
LNK
Macros
Scripting
Archive analysis
File analysis
Macro analysis
YARA
Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Exploit
Macros
Scripting
Archive analysis
Content analysis
File analysis
Macro analysis
OLE analysis
Malware/Ransomware
Exploit
Macros
Scripting
Archive analysis
Content analysis
File analysis
Macro analysis
OLE analysis
Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Exploit
Content analysis
File analysis
Malware/Ransomware
Exploit
Content analysis
File analysis
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability
Sublime Security
1y ago
Mar 21st, 2025
Credential Phishing
Scripting
Macros
Exploit
Archive analysis
Content analysis
File analysis
Credential Phishing
Scripting
Macros
Exploit
Archive analysis
Content analysis
File analysis
Attachment: LNK with embedded content
3mo ago
Jan 12th, 2026
Malware/Ransomware
Exploit
LNK
Scripting
Content analysis
Exif analysis
File analysis
Malware/Ransomware
Exploit
LNK
Scripting
Content analysis
Exif analysis
File analysis
Attachment: WinRAR CVE-2025-8088 exploitation
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Attachment: ZIP file with CVE-2026-0866 exploit
Sublime Security
1mo ago
Mar 20th, 2026
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Callback Phishing via Signable E-Signature Request
Sublime Security
3mo ago
Jan 12th, 2026
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
Callback phishing via SignFree e-signature request
Sublime Security
3mo ago
Jan 12th, 2026
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
Callback phishing via Xodo Sign comment
Sublime Security
3mo ago
Jan 12th, 2026
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
CVE-2023-5631 - Roundcube Webmail XSS via crafted SVG
Sublime Security
3mo ago
Jan 12th, 2026
Malware/Ransomware
Evasion
Exploit
HTML smuggling
Scripting
Content analysis
HTML analysis
Sender analysis
Malware/Ransomware
Evasion
Exploit
HTML smuggling
Scripting
Content analysis
HTML analysis
Sender analysis
Link: CVE-2024-21413 Microsoft Outlook Remote Code Execution Vulnerability
Sublime Security
2y ago
Feb 15th, 2024
Malware/Ransomware
Evasion
Exploit
URL analysis
Malware/Ransomware
Evasion
Exploit
URL analysis
Mass campaign: Cross Site Scripting (XSS) attempt
Sublime Security
9mo ago
Jul 16th, 2025
Malware/Ransomware
Spam
Exploit
Free email provider
Scripting
Social engineering
Content analysis
Header analysis
Sender analysis
Malware/Ransomware
Spam
Exploit
Free email provider
Scripting
Social engineering
Content analysis
Header analysis
Sender analysis
Open redirect: City of Calgary
Sublime Security
11mo ago
May 23rd, 2025
Credential Phishing
Exploit
Open redirect
Social engineering
Sender analysis
URL analysis
Credential Phishing
Exploit
Open redirect
Social engineering
Sender analysis
URL analysis
Outlook hyperlink bypass: left-to-right mark (LRM) in base HTML tag
Sublime Security
4mo ago
Dec 10th, 2025
Credential Phishing
Evasion
Exploit
Content analysis
HTML analysis
URL analysis
Credential Phishing
Evasion
Exploit
Content analysis
HTML analysis
URL analysis
17 Rules