Sublime Security

Sublime Core Feed
YARA
Learn More
Login to Sublime
Attack Types
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Reconnaissance
Spam
Tactics and Techniques
Encryption
Evasion
Exploit
Free email provider
Free file host
Free subdomain host
HTML smuggling
Image as content
Impersonation: Brand
Impersonation: Employee
Impersonation: VIP
IPFS
ISO
LNK
Lookalike domain
Macros
OneNote
Open redirect
Out of band pivot
PDF
Punycode
QR code
Scripting
Social engineering
Spoofing
Detection Methods
Archive analysis
Content analysis
Computer Vision
Exif analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Macro analysis
Natural Language Understanding
Optical Character Recognition
OLE analysis
PDF analysis
QR code analysis
Sender analysis
Threat intelligence
URL analysis
URL screenshot
Whois
XML analysis
YARA
Detection Method: YARA
YARA detection scans email messages, attachments, and extracted content for known malware, phishing patterns, or suspicious code. This detection method uses the YARA pattern matching language, which lets your security team create specific signatures based on known malicious patterns, both textual and binary.
YARA detection can identify:
Known malware families based on their distinctive code patterns
Obfuscated scripts or executables using encoding techniques
Common phishing templates with structural similarities
Suspicious binary patterns that may indicate malicious functionality
Custom threats targeting specific organizations with tailored YARA rules
Blog Post
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
This post will cover a brief timeline of QakBot’s evolution, and focus primarily on recently observed attack techniques. We’ll discuss detection methodologies and share MQL rules that anyone can use to detect, prevent, and hunt for these threats in email environments today. If you're already running Sublime, you received these new protections automatically.
Attack Types (6):
Credential Phishing
Malware/Ransomware
BEC/Fraud
Callback Phishing
Extortion
Spam
Tactics & Techniques (12):
Impersonation: Brand
PDF
Evasion
QR code
Exploit
Social engineering
Encryption
LNK
HTML smuggling
Scripting
OneNote
Macros
Rule Name & Severity
Last Updated
Types, Tactics & Capabilities
Attachment: PDF With SAI Global ISO9001 Logo
5d ago
Apr 15th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
PDF
File analysis
YARA
Credential Phishing
Impersonation: Brand
PDF
File analysis
YARA
Attachment: PDF with split QR code
5d ago
Apr 15th, 2026
Sublime Security
Credential Phishing
Evasion
PDF
QR code
File analysis
YARA
QR code analysis
Credential Phishing
Evasion
PDF
QR code
File analysis
YARA
QR code analysis
Attachment: ZIP file with CVE-2026-0866 exploit
1mo ago
Mar 20th, 2026
Sublime Security
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Attachment: PDF contains W9 or invoice YARA signatures
1mo ago
Mar 18th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
PDF
Social engineering
File analysis
YARA
BEC/Fraud
Credential Phishing
PDF
Social engineering
File analysis
YARA
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK
2mo ago
Jan 28th, 2026
Sublime Security
Malware/Ransomware
Evasion
File analysis
YARA
Malware/Ransomware
Evasion
File analysis
YARA
Attachment: Password-protected PDF with fake document indicators
2mo ago
Jan 21st, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
Malware/Ransomware
Credential Phishing
Encryption
Evasion
PDF
File analysis
YARA
Exif analysis
Link to auto-download of a suspicious file type (unsolicited)
3mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Encryption
Evasion
LNK
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
LNK
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Attachment: HTML file with excessive padding and suspicious patterns
3mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
File analysis
HTML analysis
YARA
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
File analysis
HTML analysis
YARA
Attachment: HTML file with reference to recipient and suspicious patterns
3mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
Credential Phishing
HTML smuggling
Scripting
Content analysis
File analysis
HTML analysis
Javascript analysis
YARA
Attachment: Malicious OneNote commands
3mo ago
Jan 12th, 2026
@Kyle_Parrish_
Malware/Ransomware
OneNote
Scripting
Archive analysis
Content analysis
File analysis
YARA
Malware/Ransomware
OneNote
Scripting
Archive analysis
Content analysis
File analysis
YARA
Attachment: WinRAR CVE-2025-8088 exploitation
3mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Exploit
Evasion
Archive analysis
File analysis
YARA
Link to auto-downloaded disk image in encrypted zip
3mo ago
Jan 12th, 2026
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Attachment: EML with Encrypted ZIP
3mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
YARA
Encrypted Microsoft Office files from untrusted sender
8mo ago
Aug 5th, 2025
Sublime Security
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Spam
Encryption
Evasion
File analysis
YARA
Sender analysis
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Spam
Encryption
Evasion
File analysis
YARA
Sender analysis
Attachment: DocX embedded binary
8mo ago
Aug 5th, 2025
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
Content analysis
YARA
Malware/Ransomware
Evasion
Archive analysis
Content analysis
YARA
Attachment with unscannable encrypted zip (unsolicited)
9mo ago
Jul 16th, 2025
Sublime Security
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
Sender analysis
YARA
Malware/Ransomware
Encryption
Evasion
Archive analysis
File analysis
Sender analysis
YARA
Link to auto-downloaded DMG in encrypted zip
9mo ago
Jul 16th, 2025
Sublime Security
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Malware/Ransomware
Encryption
Evasion
Social engineering
Archive analysis
File analysis
Sender analysis
URL analysis
YARA
Attachment: Malformed OLE file
2y ago
Nov 25th, 2024
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
File analysis
YARA
Credential Phishing
Malware/Ransomware
Evasion
File analysis
YARA
Attachment: JavaScript file with suspicious base64-encoded executable
2y ago
Apr 1st, 2024
Sublime Security
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
YARA
Malware/Ransomware
Evasion
Scripting
Archive analysis
File analysis
YARA
Attachment: HTML smuggling with embedded base64-encoded executable
2y ago
Mar 25th, 2024
Sublime Security
Malware/Ransomware
Evasion
HTML smuggling
Archive analysis
File analysis
HTML analysis
YARA
Malware/Ransomware
Evasion
HTML smuggling
Archive analysis
File analysis
HTML analysis
YARA
Page 1 of 2

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Attachment: PDF With SAI Global ISO9001 Logo	5d ago Apr 15th, 2026	Sublime Security	Credential Phishing Impersonation: Brand PDF File analysis YARA
Attachment: PDF with split QR code	5d ago Apr 15th, 2026	Sublime Security	Credential Phishing Evasion PDF QR code File analysis YARA QR code analysis
Attachment: ZIP file with CVE-2026-0866 exploit	1mo ago Mar 20th, 2026	Sublime Security	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
Attachment: PDF contains W9 or invoice YARA signatures	1mo ago Mar 18th, 2026	Sublime Security	BEC/Fraud Credential Phishing PDF Social engineering File analysis YARA
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK	2mo ago Jan 28th, 2026	Sublime Security	Malware/Ransomware Evasion File analysis YARA
Attachment: Password-protected PDF with fake document indicators	2mo ago Jan 21st, 2026	Sublime Security	Malware/Ransomware Credential Phishing Encryption Evasion PDF File analysis YARA Exif analysis
Link to auto-download of a suspicious file type (unsolicited)	3mo ago Jan 12th, 2026	Sublime Security	Malware/Ransomware Encryption Evasion LNK Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
Attachment: HTML file with excessive padding and suspicious patterns	3mo ago Jan 12th, 2026	Sublime Security	Credential Phishing Malware/Ransomware Evasion HTML smuggling File analysis HTML analysis YARA
Attachment: HTML file with reference to recipient and suspicious patterns	3mo ago Jan 12th, 2026	Sublime Security	Credential Phishing HTML smuggling Scripting Content analysis File analysis HTML analysis Javascript analysis YARA
Attachment: Malicious OneNote commands	3mo ago Jan 12th, 2026	@Kyle_Parrish_	Malware/Ransomware OneNote Scripting Archive analysis Content analysis File analysis YARA
Attachment: WinRAR CVE-2025-8088 exploitation	3mo ago Jan 12th, 2026	Sublime Security	Malware/Ransomware Exploit Evasion Archive analysis File analysis YARA
Link to auto-downloaded disk image in encrypted zip	3mo ago Jan 12th, 2026	@ajpc500	Malware/Ransomware Encryption Evasion Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
Attachment: EML with Encrypted ZIP	3mo ago Jan 12th, 2026	Sublime Security	Malware/Ransomware Encryption Evasion Archive analysis File analysis YARA
Encrypted Microsoft Office files from untrusted sender	8mo ago Aug 5th, 2025	Sublime Security	BEC/Fraud Callback Phishing Credential Phishing Extortion Malware/Ransomware Spam Encryption Evasion File analysis YARA Sender analysis
Attachment: DocX embedded binary	8mo ago Aug 5th, 2025	Sublime Security	Malware/Ransomware Evasion Archive analysis Content analysis YARA
Attachment with unscannable encrypted zip (unsolicited)	9mo ago Jul 16th, 2025	Sublime Security	Malware/Ransomware Encryption Evasion Archive analysis File analysis Sender analysis YARA
Link to auto-downloaded DMG in encrypted zip	9mo ago Jul 16th, 2025	Sublime Security	Malware/Ransomware Encryption Evasion Social engineering Archive analysis File analysis Sender analysis URL analysis YARA
Attachment: Malformed OLE file	2y ago Nov 25th, 2024	Sublime Security	Credential Phishing Malware/Ransomware Evasion File analysis YARA
Attachment: JavaScript file with suspicious base64-encoded executable	2y ago Apr 1st, 2024	Sublime Security	Malware/Ransomware Evasion Scripting Archive analysis File analysis YARA
Attachment: HTML smuggling with embedded base64-encoded executable	2y ago Mar 25th, 2024	Sublime Security	Malware/Ransomware Evasion HTML smuggling Archive analysis File analysis HTML analysis YARA