Sublime rules
Sublime rules for email attack detection, prevention, and threat hunting.
This repo contains open-source rules for [Sublime](https://github.com/sublime-security/sublime-platform), a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. The project is written primarily in YAML, distributed under the MIT License license, first published in 2021. Key topics include: email-security, phishing, threat-hunting.
<a href="https://sublimesecurity.com"><img src="https://user-images.githubusercontent.com/11003450/115128085-5805da00-9fa9-11eb-8c7a-dc8b708053ee.png" width="75px" alt="Sublime Logo" /></a>
Sublime Rules
by Sublime Security
This repo contains open-source rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.
Examples
- HTML smuggling
- VIP / Executive impersonation
- Malicious OneNote files
- Malicious LNK files
- Encrypted zips
Community Rule Feeds
Learn more
Follow us on Twitter for updates on new rules and detection capabilities.
Contributors
Showing top 12 contributors by commit count.
Related Repositories
albertito/chasquid
SMTP (email) server with a focus on simplicity, security, and ease of operation [mirror]
MattKeeley/Spoofy
Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.
sublime-security/sublime-platform
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.
cisagov/trustymail
Scan domains and return data based on trustworthy email best practices
gr33nm0nk2802/mailMeta
An forensics tool to help aid in the investigation of spoofed emails based off the email headers.
dmarcguardhq/dmarcguard
🛡️ A lightweight, self-hosted DMARC report parser with a beautiful Vue.js dashboard. Single-binary deployment with IMAP integration, SQLite storage, and RFC 7489 compliance. Built with Go and Vue 3 - no external dependencies required.