






Rule Name & Severity | Last Updated | Author | Types, Tactics & Capabilities | |
|---|---|---|---|---|
Link: Direct download of executable file | 3d ago Mar 2nd, 2026 | Sublime Security | /feeds/core/detection-rules/link-direct-download-of-executable-file-dbbfd077 | |
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification | 3d ago Mar 2nd, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-pdf-object-hash-encrypted-pdfs-with-fake-payment-notification-a8a19bae | |
Link: Multistage landing - ClickUp abuse | 6d ago Feb 27th, 2026 | Sublime Security | /feeds/core/detection-rules/link-multistage-landing-clickup-abuse-78a5d035 | |
Link: URL redirecting to blob URL | 9d ago Feb 24th, 2026 | Sublime Security | /feeds/core/detection-rules/link-url-redirecting-to-blob-url-1677135b | |
Link: Free file hosting with undisclosed recipients | 10d ago Feb 23rd, 2026 | Sublime Security | /feeds/core/detection-rules/link-free-file-hosting-with-undisclosed-recipients-b6281306 | |
Attachment: PDF with password in filename matching body text | 14d ago Feb 19th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-pdf-with-password-in-filename-matching-body-text-2c9c3b24 | |
Link: Direct MSI download from low reputation domain | 14d ago Feb 19th, 2026 | Sublime Security | /feeds/core/detection-rules/link-direct-msi-download-from-low-reputation-domain-1eb77537 | |
Russia return-path TLD (untrusted sender) | 20d ago Feb 13th, 2026 | Sublime Security | /feeds/core/detection-rules/russia-return-path-tld-untrusted-sender-588b3954 | |
File sharing link from suspicious sender domain | 20d ago Feb 13th, 2026 | Sublime Security | /feeds/core/detection-rules/file-sharing-link-from-suspicious-sender-domain-95f20354 | |
Attachment: Self-sender PDF with minimal content and view prompt | 21d ago Feb 12th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-self-sender-pdf-with-minimal-content-and-view-prompt-07670a8c | |
Open redirect: embluemail.com | 21d ago Feb 12th, 2026 | Sublime Security | /feeds/core/detection-rules/open-redirect-embluemailcom-48c5abd3 | |
Anthropic Magic String in HTML | 24d ago Feb 9th, 2026 | Sublime Security | /feeds/core/detection-rules/anthropic-magic-string-in-html-d860c6a8 | |
Attachment: cmd file extension | 24d ago Feb 9th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-cmd-file-extension-a902b8ed | |
New link domain (<=10d) from untrusted sender | 27d ago Feb 6th, 2026 | Sublime Security | /feeds/core/detection-rules/new-link-domain-less10d-from-untrusted-sender-4805b0e6 | |
macOS malware: Compiled AppleScript with document double-extension | 28d ago Feb 5th, 2026 | Sublime Security | /feeds/core/detection-rules/macos-malware-compiled-applescript-with-document-double-extension-9669c169 | |
Link: 9WOLF phishkit initial landing URI | 1mo ago Jan 30th, 2026 | Sublime Security | /feeds/core/detection-rules/link-9wolf-phishkit-initial-landing-uri-a165e206 | |
Attachment: ICS with embedded Javascript in SVG file | 1mo ago Jan 29th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-ics-with-embedded-javascript-in-svg-file-d5201a19 | |
Attachment: Employment contract update with suspicious file naming | 1mo ago Jan 28th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-employment-contract-update-with-suspicious-file-naming-8bdcd2da | |
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK | 1mo ago Jan 28th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-ms-office-or-rtf-file-with-shellexplorer1-com-object-with-embedded-lnk-53a29f61 | |
Attachment: Password-protected PDF with fake document indicators | 1mo ago Jan 21st, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440 |