-
Notifications
You must be signed in to change notification settings - Fork 85
Pull requests: sublime-security/sublime-rules
Author
Label
Projects
Milestones
Reviews
Assignee
Sort
Pull requests list
Update fake_thread_suspicious_indicators.yml to
in-test-rules
PR is in our testing suite to collect telemetry
#3741
opened Jan 7, 2026 by
zoomequipd
•
Draft
Update credential_theft_cloud_storage_impersonation.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3740
opened Jan 6, 2026 by
JFarina5
Loading…
Create bec_vip_impersonation_mismatched_reply_to.yml ESC-4981
in-test-rules
PR is in our testing suite to collect telemetry
#3738
opened Jan 6, 2026 by
IndiaAce
Loading…
Update recon_large_recipients_unknown.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3737
opened Jan 5, 2026 by
cybher0808
Loading…
Create impersonate_fake_thread_cred_theft.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3736
opened Jan 5, 2026 by
IndiaAce
Loading…
Create lookalike_local_part_fake_reply.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3735
opened Jan 5, 2026 by
IndiaAce
Loading…
Create impersonate_org_domain_fail_auth.yml ESC-5582
in-test-rules
PR is in our testing suite to collect telemetry
#3734
opened Jan 5, 2026 by
IndiaAce
Loading…
Update impersonation_microsoft_credential_theft.yml ESC-5582
in-test-rules
PR is in our testing suite to collect telemetry
#3733
opened Jan 5, 2026 by
IndiaAce
Loading…
Update impersonation_sharepoint_fake_file_share.yml ESC-5582
in-test-rules
PR is in our testing suite to collect telemetry
#3732
opened Jan 5, 2026 by
IndiaAce
Loading…
Create sender_display_name_kindly.yml
in-test-rules
PR is in our testing suite to collect telemetry
review-needed
Indicates that a PR is waiting for review
#3729
opened Jan 5, 2026 by
D-Bolton
Loading…
Update brand_impersonation_adobe_sign.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3728
opened Jan 5, 2026 by
zoomequipd
Loading…
Enhance detection rules for SharePoint credential theft
in-test-rules
PR is in our testing suite to collect telemetry
#3724
opened Dec 31, 2025 by
peterdj45
Loading…
Add detection rule for Google Forms abuse
hunting-required
Hunts needed to validate rule efficacy
test-rules:excluded:link_analysis
Link analysis in rule, excluding from test rules
#3723
opened Dec 31, 2025 by
peterdj45
Loading…
Refine regex patterns for phishing detection
in-test-rules
PR is in our testing suite to collect telemetry
#3722
opened Dec 30, 2025 by
missingn0pe
Loading…
Create headers_utf8_base64_encoded_from.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3720
opened Dec 30, 2025 by
MSAdministrator
Loading…
Create headers_arc_seal_validation_failure.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3719
opened Dec 30, 2025 by
MSAdministrator
Loading…
Add detection rule for AuthentiSign impersonation
in-test-rules
PR is in our testing suite to collect telemetry
#3718
opened Dec 29, 2025 by
missingn0pe
Loading…
Create fake_ooo_urgent_financial_request.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3717
opened Dec 29, 2025 by
IndiaAce
Loading…
Create attachment_pdf_invoice_generator.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3716
opened Dec 29, 2025 by
JFarina5
Loading…
Create link_url_with_recipient_targeting_and_special_characters.yml
in-test-rules
PR is in our testing suite to collect telemetry
review-needed
Indicates that a PR is waiting for review
#3715
opened Dec 24, 2025 by
IndiaAce
Loading…
Update impersonation_sender_o365_mail.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3714
opened Dec 24, 2025 by
zoomequipd
Loading…
Update impersonation_netflix.yml
hunting-required
Hunts needed to validate rule efficacy
test-rules:excluded:link_analysis
Link analysis in rule, excluding from test rules
#3711
opened Dec 23, 2025 by
zoomequipd
Loading…
Create subject_sus_bracket_ref.yml
in-test-rules
PR is in our testing suite to collect telemetry
#3710
opened Dec 23, 2025 by
zoomequipd
Loading…
Previous Next
ProTip!
Follow long discussions with comments:>50.