hilt86/sublime-rules

Sublime rules for phishing detection, prevention, and threat hunting.

Sublime Rules

by Sublime Security

This repo contains open-source detection rules and queries for the Sublime Platform.

Examples

• HTML smuggling
• Encrypted zips
• High risk VBA macros
• Malicious LNK files
• VIP / Executive impersonation

Community Rule Feeds

• DelivrTo
• vector-sec
• amitchell516

Learn more

• Sublime home page
• Sublime Platform overview
• Message Query Language (MQL) reference - Sublime's DSL purpose-built for email analysis
• Release log

Follow us on Twitter for updates on new rules and detection capabilities.