Sublime Core Feed

Login to Sublime

Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Apr 28th, 2025

Feed Source

Tactic or Technique is

Rule Name & Severity	Author	Last Updated	Labels
CVE-2023-5631 - Roundcube Webmail XSS via crafted SVG	Sublime Security	1y ago Feb 23rd, 2024	Malware/Ransomware Evasion Exploit HTML smuggling Scripting Content analysis HTML analysis Sender analysis	/feeds/core/detection-rules/cve-2023-5631-roundcube-webmail-xss-via-crafted-svg-8405d61b
HTML smuggling containing recipient email address	Sublime Security	28d ago Apr 1st, 2025	Credential Phishing Malware/Ransomware Evasion HTML smuggling Scripting Archive analysis File analysis Sender analysis	/feeds/core/detection-rules/html-smuggling-containing-recipient-email-address-af32ff2f
Mass campaign: Cross Site Scripting (XSS) attempt	Sublime Security	1y ago Mar 27th, 2024	Malware/Ransomware Spam Exploit Free email provider Scripting Social engineering Content analysis Header analysis Sender analysis	/feeds/core/detection-rules/mass-campaign-cross-site-scripting-xss-attempt-6cbb7124
Suspected Cross-Site Scripting (XSS) found in subject	Sublime Security	2mo ago Feb 24th, 2025	Credential Phishing Evasion Scripting Content analysis Sender analysis	/feeds/core/detection-rules/suspected-cross-site-scripting-xss-found-in-subject-8a946cfa
Suspected WordPress abuse with Cross-Site Scripting (XSS) indicators	Sublime Security	3mo ago Jan 29th, 2025	Malware/Ransomware Credential Phishing Scripting Impersonation: Brand Social engineering Content analysis Sender analysis	/feeds/core/detection-rules/suspected-wordpress-abuse-with-cross-site-scripting-xss-indicators-9c21225b