Detection Method: File analysis

File analysis breaks down and inspects file contents, formats, and embedded elements to uncover hidden threats. This method goes beyond basic file attributes, deeply examining the inner structure of files to find potentially malicious content that looks legitimate on the surface.
File analysis helps detect:
  • Malicious macros in Office documents (Word, Excel, PowerPoint)
  • Obfuscated scripts hidden in PDFs or other document types
  • Executable code disguised in non-executable files
  • Hidden text content using encoding or steganography
  • Suspicious metadata or file properties suggesting tampering
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (7):
ICS Phishing
Credential Phishing
BEC/Fraud
Extortion
Spam
Malware/Ransomware
Callback Phishing
Tactics & Techniques (25):
Social engineering
Free file host
Evasion
PDF
Impersonation: Employee
Impersonation: VIP
Free subdomain host
Lookalike domain
Open redirect
Macros
Free email provider
Image as content
ICS Phishing
Encryption
HTML smuggling
Out of band pivot
Impersonation: Brand
Spoofing
Exploit
QR code
Scripting
LNK
OneNote
IPFS
ISO
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: ICS voicemail lure with suspicious link
1h ago
Sep 16th, 2026
Sublime Security
ICS Phishing
Credential Phishing
Social engineering
Free file host
Evasion
File analysis
Content analysis
URL analysis
Whois
Header analysis
Attachment: PDF with a suspicious string and single URL
2h ago
Sep 16th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
Suspicious attachment with unscannable Cloudflare link
4h ago
Sep 16th, 2026
Sublime Security
Credential Phishing
Evasion
PDF
Social engineering
Impersonation: Employee
Impersonation: VIP
File analysis
URL analysis
Sender analysis
Content analysis
Header analysis
Natural Language Understanding
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
22h ago
Sep 15th, 2026
Sublime Security
BEC/Fraud
ICS Phishing
Social engineering
Free file host
Free subdomain host
Lookalike domain
File analysis
Content analysis
URL analysis
Whois
Attachment: Legal themed message or PDF with suspicious indicators
1d ago
Sep 15th, 2026
Sublime Security
Credential Phishing
Extortion
BEC/Fraud
Evasion
PDF
Social engineering
Content analysis
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Whois
Header analysis
Exif analysis
Link: Abused Trac-link URL
2d ago
Sep 14th, 2026
Sublime Security
Credential Phishing
Open redirect
Evasion
PDF
URL analysis
File analysis
Content analysis
Attachment: ICS calendar invite with Google share.google URL shortener in google.<tld>/share.google path form
2d ago
Sep 14th, 2026
Sublime Security
Spam
Credential Phishing
Open redirect
Social engineering
URL analysis
Content analysis
File analysis
Attachment: Google share.google URL shortener in google.<tld>/share.google path form
2d ago
Sep 14th, 2026
Sublime Security
Spam
Credential Phishing
Open redirect
Social engineering
URL analysis
Content analysis
File analysis
Attachment: PDF object hash cred phish
5d ago
Sep 11th, 2026
Sublime Security
Malware/Ransomware
PDF
File analysis
Threat intelligence
Attachment: Excel file with hyperlinks to suspicious domains
5d ago
Sep 11th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Free file host
Free subdomain host
Social engineering
Natural Language Understanding
Content analysis
Exif analysis
File analysis
URL analysis
Attachment: XLS with legal confidentiality disclaimer
6d ago
Sep 10th, 2026
Sublime Security
Malware/Ransomware
BEC/Fraud
Social engineering
Macros
File analysis
Content analysis
Attachment: PDF with EOF MD5 hash marker
6d ago
Sep 10th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
Evasion
File analysis
YARA
Attachment: PDF with dub.sh shortened link
7d ago
Sep 9th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
PDF
Social engineering
Evasion
File analysis
URL analysis
Attachment: ICS calendar invite with photo/file share lure
7d ago
Sep 9th, 2026
Sublime Security
Credential Phishing
Free email provider
Social engineering
Open redirect
Image as content
File analysis
Natural Language Understanding
Content analysis
URL analysis
Sender analysis
Header analysis
Attachment: PDF with bolded passcode
8d ago
Sep 8th, 2026
Sublime Security
Credential Phishing
PDF
Evasion
Social engineering
HTML analysis
Content analysis
File analysis
Attachment: ICS calendar file with suspicious UID domain
12d ago
Sep 4th, 2026
Sublime Security
ICS Phishing
Credential Phishing
BEC/Fraud
Social engineering
File analysis
Content analysis
Attachment: ICS file with excessive custom properties
12d ago
Sep 4th, 2026
Sublime Security
Malware/Ransomware
Evasion
ICS Phishing
File analysis
Content analysis
Attachment: ICS calendar file with recipient address in UID field
12d ago
Sep 4th, 2026
Sublime Security
Credential Phishing
Social engineering
File analysis
Content analysis
Attachment: ICS Link With Valueless Base64 Query Parameter
12d ago
Sep 4th, 2026
Sublime Security
ICS Phishing
Credential Phishing
Evasion
Social engineering
File analysis
URL analysis
Header analysis
Attachment: Word document with hyperlink and fraud language
12d ago
Sep 4th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Free email provider
Social engineering
Evasion
File analysis
XML analysis
HTML analysis
URL analysis
Natural Language Understanding
Sender analysis
Page 1 of 17