Sublime Security Sublime Rules
Open-source detection rules for email attacks like BEC, phishing, and malware
Open-source detection rules for email attacks like BEC, phishing, and malware
Checked October 2026.
Sublime Rules is an open-source repository containing detection rules for the Sublime Security platform. The repository provides rules designed to identify and prevent various email-based attacks including business email compromise (BEC), credential phishing, and malware delivery.
The repository is organized into multiple categories including detection rules, discovery rules, DLP discovery rules, automations, insights, and YARA rules. It includes specific detection capabilities for HTML smuggling, VIP and executive impersonation, malicious OneNote files, malicious LNK files, and encrypted zip attachments.
The rules are written using Message Query Language (MQL), a query language specific to the Sublime platform for analyzing email messages. The repository contains over 3,000 commits and has contributions from 71 contributors, indicating active development and community involvement.
The project is released under the MIT license, making it freely available for use and modification. The repository includes sample email files (EMLs), tutorial files, and scripts to support rule development and testing. Community members have also created additional rule feeds that complement the main repository.
Sign in with a free account to see the full list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Common questions about Sublime Security Sublime Rules: features, pricing and alternatives.
Sublime Security Sublime Rules is a product by Sublime Security in the Detection Engineering category. It covers Detection Rules, Open Source and YARA.
Sublime Security Sublime Rules is free. Download and setup instructions are at https://github.com/sublime-security/sublime-rules/.
Alternatives to Sublime Security Sublime Rules listed on CybersecTools:
Compare all Sublime Security Sublime Rules alternatives at https://cybersectools.com/alternatives/sublime-security-sublime-rules
Sublime Security Sublime Rules is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A tool for deep analysis of malicious files using ClamAV and YARA rules, with features like scoring suspect files, building visual tree graphs, and extracting specific patterns.
A strings statistics calculator for YARA rules to aid malware research.
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing, utilizing Message Query Language (MQL) for behavior description.
SALO is a framework that generates synthetic log events for security testing and research without requiring actual infrastructure or triggering real events.
A Sysmon configuration file template with detailed explanations and tutorial-like features.
A Sysmon configuration repository for customizing Microsoft Sysinternals Sysmon configurations with modular setup.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,033 products.
Connect your AI
