Sublime Core Feed | Sublime Security

Sublime Core Feed
Login to Sublime
Sublime Core FeedThis repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Sublime Security
Last updated May 12th, 2026
Feed Source
GitHub
Tactic or Technique is
Rule Name & Severity
Last Updated
Attachment: Calendar file with invisible Unicode characters
Sublime Security
14d ago
Apr 28th, 2026
BEC/Fraud
Credential Phishing
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Content analysis
BEC/Fraud
Credential Phishing
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Content analysis
Attachment: Calendar invite from recently registered domain
Sublime Security
14d ago
Apr 28th, 2026
Callback Phishing
Evasion
ICS Phishing
Social engineering
File analysis
Whois
Callback Phishing
Evasion
ICS Phishing
Social engineering
File analysis
Whois
Attachment: Calendar invite with Google redirect and invoice request
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
BEC/Fraud
ICS Phishing
Open redirect
Social engineering
File analysis
Natural Language Understanding
URL analysis
Credential Phishing
BEC/Fraud
ICS Phishing
Open redirect
Social engineering
File analysis
Natural Language Understanding
URL analysis
Attachment: Calendar invite with suspicious link leading to an open redirect
Sublime Security
14d ago
Apr 28th, 2026
Spam
Free email provider
Free file host
Free subdomain host
ICS Phishing
Open redirect
Content analysis
URL analysis
Spam
Free email provider
Free file host
Free subdomain host
ICS Phishing
Open redirect
Content analysis
URL analysis
Attachment: HTML smuggling with atob and high entropy via calendar invite
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
ICS Phishing
Scripting
File analysis
HTML analysis
Javascript analysis
Sender analysis
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
ICS Phishing
Scripting
File analysis
HTML analysis
Javascript analysis
Sender analysis
Attachment: HTML smuggling with eval and atob via calendar invite
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
ICS Phishing
Scripting
File analysis
HTML analysis
Javascript analysis
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
ICS Phishing
Scripting
File analysis
HTML analysis
Javascript analysis
Attachment: ICS calendar with embedded file from internal sender with SPF failure
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Spoofing
Evasion
ICS Phishing
File analysis
Header analysis
Sender analysis
Credential Phishing
Spoofing
Evasion
ICS Phishing
File analysis
Header analysis
Sender analysis
Attachment: ICS file with AWS Lambda URL
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Malware/Ransomware
Evasion
Free file host
ICS Phishing
Content analysis
File analysis
URL analysis
Credential Phishing
Malware/Ransomware
Evasion
Free file host
ICS Phishing
Content analysis
File analysis
URL analysis
Attachment: ICS file with excessive custom properties
Sublime Security
14d ago
Apr 28th, 2026
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Content analysis
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Content analysis
Attachment: ICS file with meeting prefix
Sublime Security
14d ago
Apr 28th, 2026
BEC/Fraud
Credential Phishing
ICS Phishing
Social engineering
File analysis
Header analysis
BEC/Fraud
Credential Phishing
ICS Phishing
Social engineering
File analysis
Header analysis
Attachment: ICS file with non-Gregorian calendar scale
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Evasion
ICS Phishing
File analysis
Content analysis
Credential Phishing
Evasion
ICS Phishing
File analysis
Content analysis
Attachment: ICS with embedded document
Sublime Security
14d ago
Apr 28th, 2026
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Attachment: ICS with embedded Javascript in SVG file
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
Malware/Ransomware
Scripting
Evasion
ICS Phishing
File analysis
Javascript analysis
Sender analysis
Credential Phishing
Malware/Ransomware
Scripting
Evasion
ICS Phishing
File analysis
Javascript analysis
Sender analysis
Attachment: ICS with employee policy review lure
Sublime Security
14d ago
Apr 28th, 2026
Credential Phishing
BEC/Fraud
Evasion
ICS Phishing
Social engineering
File analysis
Content analysis
Credential Phishing
BEC/Fraud
Evasion
ICS Phishing
Social engineering
File analysis
Content analysis
Callback phishing via calendar invite
Sublime Security
6d ago
May 6th, 2026
Callback Phishing
Social engineering
Evasion
ICS Phishing
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Callback Phishing
Social engineering
Evasion
ICS Phishing
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender
Sublime Security
14d ago
Apr 28th, 2026
Spam
Free email provider
Free file host
ICS Phishing
Open redirect
Social engineering
Content analysis
Sender analysis
URL analysis
Spam
Free email provider
Free file host
ICS Phishing
Open redirect
Social engineering
Content analysis
Sender analysis
URL analysis
Non-RFC compliant calendar files from unsolicited sender
Sublime Security
14d ago
Apr 28th, 2026
Evasion
ICS Phishing
Social engineering
Archive analysis
Content analysis
File analysis
Sender analysis
Evasion
ICS Phishing
Social engineering
Archive analysis
Content analysis
File analysis
Sender analysis
Service abuse: Google Calendar notification with callback scam language
Sublime Security
14d ago
Apr 28th, 2026
Callback Phishing
ICS Phishing
Out of band pivot
Social engineering
Natural Language Understanding
Content analysis
Sender analysis
Callback Phishing
ICS Phishing
Out of band pivot
Social engineering
Natural Language Understanding
Content analysis
Sender analysis
18 Rules