sentry

click_tracking

disable_posthog_tracking

suborganization_creation

microsoft_non_admin_onboarding_bypass_tenant_verification

hide_hip_progress_bar

expose_inline_message_meta

safelinks_click_tracking

show_enable_inline_processing

ms365_cert_based_auth

mdv_redirect_original_canonical_id_to_cluster_id

ignore_asr_priority_counts

self_serve_fix_gmail_reports

inline_webhook_alerts

force_disable_all_frontend_slurp_restrictions

onboarding_abuse_mailbox_route

mdv_asa_button_all_messages

asa_full_response

disable_mailboxes_ui

user_reports_top_reporters_ui

oletools_output_ui

user_reports_top_labels_ui

stratum_mlvs

threat_log_passive_mode

ade_internal_button

export_search_emls

overview_show_malicious_classifications

export_search_emls_limit

graymail_action

quantum_hunts_ui

user_reports_overview_v3

enable_asa_in_mlv

attack_insights_overview_v3

share_with_ts_action_id

ts_redirect_base_url

dlp_beta_ui

delete_calendar_events_action

search_v1_url

grandchild_org_creation

dlp_ga_ui

agentic_products_enabled

feeds_https_auth

message_groups_rule_type_filter

vendor_management_ui

dlp_rules_ui

dlp_public_beta_ui

phishing_sim_ui

pdf_exports_mvp

user_report_results_templating_and_addresses

user_report_custom_addresses

user_report_custom_logo

can_access_child_orgs_permission

auth_default_no_child_org_access

internal_only_mlv_ui

hunt_job_status_polling_interval_config

disable_ade_for_internal_only

attack_insights_internal_mode

export_use_new_export_task

disposition_in_mlv

user_report_custom_logo_2

inline_ga_ui

support_exclusions_in_feeds

inline_delivery_next_hop_ui

overview_v2_graymail_classification

user_report_custom_logo_ga

terms_and_conditions_checkbox_clickwrap_id

labs_quantum_hunts

role_based_unit_list_type

remove_large_text_fields_from_mdm_ui

graymail_user_preference_ui

trusted_sender_ip_ui

ade_webhook_ui

quarantine_digest_beta

vault_color_refresh

Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Rule Name & Severity	Author	Last Updated	Labels
Link to a domain with punycode characters	@ajpc500	4mo ago Nov 12th, 2025	Credential Phishing Evasion Lookalike domain Punycode Sender analysis URL analysis
Punycode sender domain	Sublime Security	3y ago Aug 21st, 2023	Credential Phishing Malware/Ransomware Evasion Lookalike domain Punycode Social engineering Sender analysis