






Rule Name & Severity | Last Updated | Author | Types, Tactics & Capabilities | |
|---|---|---|---|---|
Russia return-path TLD (untrusted sender) | 4d ago Feb 13th, 2026 | Sublime Security | /feeds/core/detection-rules/russia-return-path-tld-untrusted-sender-588b3954 | |
File sharing link from suspicious sender domain | 4d ago Feb 13th, 2026 | Sublime Security | /feeds/core/detection-rules/file-sharing-link-from-suspicious-sender-domain-95f20354 | |
Attachment: Self-sender PDF with minimal content and view prompt | 5d ago Feb 12th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-self-sender-pdf-with-minimal-content-and-view-prompt-07670a8c | |
Open redirect: embluemail.com | 5d ago Feb 12th, 2026 | Sublime Security | /feeds/core/detection-rules/open-redirect-embluemailcom-48c5abd3 | |
Anthropic Magic String in HTML | 8d ago Feb 9th, 2026 | Sublime Security | /feeds/core/detection-rules/anthropic-magic-string-in-html-d860c6a8 | |
Attachment: cmd file extension | 8d ago Feb 9th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-cmd-file-extension-a902b8ed | |
New link domain (<=10d) from untrusted sender | 11d ago Feb 6th, 2026 | Sublime Security | /feeds/core/detection-rules/new-link-domain-less10d-from-untrusted-sender-4805b0e6 | |
macOS malware: Compiled AppleScript with document double-extension | 12d ago Feb 5th, 2026 | Sublime Security | /feeds/core/detection-rules/macos-malware-compiled-applescript-with-document-double-extension-9669c169 | |
Link: 9WOLF phishkit initial landing URI | 18d ago Jan 30th, 2026 | Sublime Security | /feeds/core/detection-rules/link-9wolf-phishkit-initial-landing-uri-a165e206 | |
Attachment: ICS with embedded Javascript in SVG file | 19d ago Jan 29th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-ics-with-embedded-javascript-in-svg-file-d5201a19 | |
Attachment: Employment contract update with suspicious file naming | 20d ago Jan 28th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-employment-contract-update-with-suspicious-file-naming-8bdcd2da | |
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK | 20d ago Jan 28th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-ms-office-or-rtf-file-with-shellexplorer1-com-object-with-embedded-lnk-53a29f61 | |
Attachment: Password-protected PDF with fake document indicators | 27d ago Jan 21st, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-password-protected-pdf-with-fake-document-indicators-b45e4440 | |
Link: Excessive URL rewrite encoders | 27d ago Jan 21st, 2026 | Sublime Security | /feeds/core/detection-rules/link-excessive-url-rewrite-encoders-b88e53a7 | |
Open redirect: unitedwaynwvt.org | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/open-redirect-unitedwaynwvtorg-da6eb27a | |
Brand impersonation: Sharepoint fake file share | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/brand-impersonation-sharepoint-fake-file-share-ff8b296b | |
Link to Google Apps Script macro via comment tagging | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/link-to-google-apps-script-macro-via-comment-tagging-66fecd30 | |
Suspicious Links to Cloudflare R2 and Edge Services | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/suspicious-links-to-cloudflare-r2-and-edge-services-5dd3e5c8 | |
Attachment: Calendar file with invisible Unicode characters | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/attachment-calendar-file-with-invisible-unicode-characters-050fceac | |
Subject and sender display name contains matching long alphanumeric string | 1mo ago Jan 12th, 2026 | Sublime Security | /feeds/core/detection-rules/subject-and-sender-display-name-contains-matching-long-alphanumeric-string-a8a0c831 |