






Rule Name & Severity | Last Updated | Author | Types, Tactics & Capabilities | |
|---|---|---|---|---|
Brand impersonation: Google Drive fake file share | 6h ago Dec 4th, 2025 | Sublime Security | /feeds/core/detection-rules/brand-impersonation-google-drive-fake-file-share-b424a941 | |
Attachment: HTML smuggling with ROT13 | 3d ago Dec 2nd, 2025 | @Kyle_Parrish_ | /feeds/core/detection-rules/attachment-html-smuggling-with-rot13-6eacc4cf | |
Brand impersonation: Sharepoint fake file share | 3d ago Dec 2nd, 2025 | Sublime Security | /feeds/core/detection-rules/brand-impersonation-sharepoint-fake-file-share-ff8b296b | |
Attachment: Encrypted zip file with payment-related lure | 10d ago Nov 25th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-encrypted-zip-file-with-payment-related-lure-5d1eb7af | |
Attachment: OLE external relationship containing file scheme link to executable filetype | 11d ago Nov 24th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-ole-external-relationship-containing-file-scheme-link-to-executable-filetype-33bf6fd4 | |
Attachment: HTML smuggling with base64 encoded ZIP file | 15d ago Nov 20th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-html-smuggling-with-base64-encoded-zip-file-47e388de | |
Link to auto-download of a suspicious file type (unsolicited) | 17d ago Nov 18th, 2025 | Sublime Security | /feeds/core/detection-rules/link-to-auto-download-of-a-suspicious-file-type-unsolicited-67ae2152 | |
Link: GoPhish default rid value | 23d ago Nov 12th, 2025 | Sublime Security | /feeds/core/detection-rules/link-gophish-default-rid-value-6d2b9c8a | |
VIP Impersonation via Google Group relay with suspicious indicators | 23d ago Nov 12th, 2025 | Sublime Security | /feeds/core/detection-rules/vip-impersonation-via-google-group-relay-with-suspicious-indicators-57f9cd3b | |
Attachment: 7z Archive Containing RAR File | 27d ago Nov 8th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-7z-archive-containing-rar-file-1a629bb4 | |
Brand impersonation: Paperless Post | 29d ago Nov 6th, 2025 | Sublime Security | /feeds/core/detection-rules/brand-impersonation-paperless-post-e9ec5e09 | |
Headers: Outlook Express mailer | 29d ago Nov 6th, 2025 | Sublime Security | /feeds/core/detection-rules/headers-outlook-express-mailer-b7a698de | |
Attachment: EML with Encrypted ZIP | 1mo ago Nov 4th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-eml-with-encrypted-zip-6897a8f7 | |
Attachment: HTML smuggling with atob and high entropy | 1mo ago Nov 4th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-html-smuggling-with-atob-and-high-entropy-03fcac11 | |
HTML smuggling containing recipient email address | 1mo ago Nov 4th, 2025 | Sublime Security | /feeds/core/detection-rules/html-smuggling-containing-recipient-email-address-af32ff2f | |
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts | 1mo ago Nov 3rd, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-html-file-with-excessive-const-declarations-and-abnormally-long-timeouts-66f8a07a | |
Link: Multiple HTTP protocols in single URL | 1mo ago Oct 30th, 2025 | Sublime Security | /feeds/core/detection-rules/link-multiple-http-protocols-in-single-url-92f9d241 | |
Attachment: Any .sap file (unsolicited) | 1mo ago Oct 27th, 2025 | Sublime Security | /feeds/core/detection-rules/attachment-any-sap-file-unsolicited-220ed3de | |
Link: Apple App Store malicious ad manager themed apps from free email provider | 1mo ago Oct 17th, 2025 | Sublime Security | /feeds/core/detection-rules/link-apple-app-store-malicious-ad-manager-themed-apps-from-free-email-provider-9ce402c6 | |
QR code to auto-download of a suspicious file type (unsolicited) | 1mo ago Oct 17th, 2025 | Sublime Security | /feeds/core/detection-rules/qr-code-to-auto-download-of-a-suspicious-file-type-unsolicited-eed87ea2 |