Detection Method: File analysis

File analysis breaks down and inspects file contents, formats, and embedded elements to uncover hidden threats. This method goes beyond basic file attributes, deeply examining the inner structure of files to find potentially malicious content that looks legitimate on the surface.
File analysis helps detect:
  • Malicious macros in Office documents (Word, Excel, PowerPoint)
  • Obfuscated scripts hidden in PDFs or other document types
  • Executable code disguised in non-executable files
  • Hidden text content using encoding or steganography
  • Suspicious metadata or file properties suggesting tampering
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (6):
Credential Phishing
Callback Phishing
Malware/Ransomware
BEC/Fraud
Extortion
Spam
Tactics & Techniques (24):
Impersonation: Brand
Social engineering
Out of band pivot
Evasion
Encryption
PDF
QR code
Scripting
Image as content
Macros
Exploit
Impersonation: Employee
Impersonation: VIP
LNK
Free email provider
Open redirect
Free subdomain host
Free file host
HTML smuggling
Lookalike domain
OneNote
IPFS
Spoofing
ISO
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Dropbox
1d ago
Jan 22nd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
File analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-dropbox-61f11d12
Callback phishing in body or attachment (untrusted sender)
1d ago
Jan 22nd, 2026
Sublime Security
Callback Phishing
Out of band pivot
Social engineering
Content analysis
File analysis
Optical Character Recognition
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/callback-phishing-in-body-or-attachment-untrusted-sender-b93c6f94
Callback phishing via calendar invite
1d ago
Jan 22nd, 2026
Sublime Security
Callback Phishing
Social engineering
Evasion
File analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/callback-phishing-via-calendar-invite-95c84360
Attachment: Password-protected PDF with fake document indicators
2d ago
Jan 21st, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
/feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440
Attachment: PDF with recipient email in link
2d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
PDF
QR code
Encryption
Social engineering
File analysis
QR code analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-recipient-email-in-link-0399d08f
Attachment: QR code with recipient targeting and special characters
2d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
QR code
Social engineering
Evasion
File analysis
QR code analysis
URL analysis
Computer Vision
/feeds/core/detection-rules/attachment-qr-code-with-recipient-targeting-and-special-characters-fc9e1c09
Attachment: Invoice and W-9 PDFs with suspicious creators
2d ago
Jan 21st, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
/feeds/core/detection-rules/attachment-invoice-and-w-9-pdfs-with-suspicious-creators-305d6e32
Link to auto-downloaded file with Google Drive branding
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Impersonation: Brand
Social engineering
Content analysis
File analysis
Optical Character Recognition
URL analysis
URL screenshot
/feeds/core/detection-rules/link-to-auto-downloaded-file-with-google-drive-branding-4b5343be
Attachment: PowerPoint with suspicious hyperlink
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
Scripting
Exif analysis
File analysis
/feeds/core/detection-rules/attachment-powerpoint-with-suspicious-hyperlink-0a999fb1
Attachment: QR code link with base64-encoded recipient address
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
QR code
Image as content
Social engineering
Evasion
PDF
Macros
Computer Vision
File analysis
Natural Language Understanding
QR code analysis
Sender analysis
/feeds/core/detection-rules/attachment-qr-code-link-with-base64-encoded-recipient-address-927a0c1a
Attachment: WinRAR CVE-2025-8088 exploitation
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
/feeds/core/detection-rules/attachment-winrar-cve-2025-8088-exploitation-33b3a82b
Attachment: SFX archive containing commands
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
Scripting
File analysis
/feeds/core/detection-rules/attachment-sfx-archive-containing-commands-343e6c8c
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation
11d ago
Jan 12th, 2026
@ajpc500
Malware/Ransomware
Macros
Scripting
Content analysis
File analysis
Macro analysis
/feeds/core/detection-rules/attachment-macro-with-suspected-use-of-com-shellbrowserwindow-object-for-process-creation-527fc7f0
Attachment: Small text file with link containing recipient email address
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
File analysis
URL analysis
/feeds/core/detection-rules/attachment-small-text-file-with-link-containing-recipient-email-address-c0472c9d
Attachment soliciting user to enable macros
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Optical Character Recognition
Sender analysis
/feeds/core/detection-rules/attachment-soliciting-user-to-enable-macros-e9d75515
Attachment: .csproj with suspicious commands
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Evasion
Scripting
File analysis
/feeds/core/detection-rules/attachment-csproj-with-suspicious-commands-fe45b81d
Suspicious attachment with unscannable Cloudflare link
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Evasion
PDF
Social engineering
Impersonation: Employee
Impersonation: VIP
File analysis
URL analysis
Sender analysis
Content analysis
Header analysis
Natural Language Understanding
/feeds/core/detection-rules/suspicious-attachment-with-unscannable-cloudflare-link-00f92b6f
Suspicious VBA macros from untrusted sender
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Macros
File analysis
Macro analysis
Sender analysis
/feeds/core/detection-rules/suspicious-vba-macros-from-untrusted-sender-37cec120
Attachment: Embedded Javascript in SVG file
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Scripting
Archive analysis
File analysis
Sender analysis
XML analysis
/feeds/core/detection-rules/attachment-embedded-javascript-in-svg-file-f70293bc
Attachment: Uncommon compressed file
11d ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Archive analysis
File analysis
/feeds/core/detection-rules/attachment-uncommon-compressed-file-0c6fba7a
Page 1 of 12