Detection rules › Sublime MQL

Sublime MQL detection rules

1405 detection rules grouped into 95 topic pages by rule-name prefix.

Group	Rules
`abuse`	38
`abused`	1
`anthropic`	1
`appsheet`	1
`asr`	2
`attachment`	269
`bec`	11
`beta`	83
`body`	34
`brand`	66
`callback`	24
`canva`	2
`cc`	1
`clickfunnels`	1
`cold`	1
`comp`	1
`cred`	2
`credential`	22
`cve`	2
`deceptive`	2
`disposable`	1
`dlp`	130
`docusign`	1
`dropbox`	1
`eml`	2
`evasion`	3
`fake`	6
`fictitious`	1
`file`	3
`francais`	1
`free`	2
`fuzzy`	1
`generic`	1
`google`	1
`gophish`	1
`govdelivery`	1
`header`	2
`headers`	18
`hr`	1
`html`	4
`image`	1
`impersonation`	114
`infra`	1
`infrastructure`	2
`inline`	1
`intuit`	1
`invoicera`	1
`issuu`	1
`job`	1
`link`	226
`lookalike`	2
`macos`	1
`malformed`	1
`mass`	2
`monday`	1
`ms`	1
`observed`	7
`open`	117
`paypal`	1
`phaas`	1
`phishing`	2
`predatory`	1
`punycode`	1
`qr`	2
`recipient`	1
`recipients`	3
`recon`	8
`recruitee`	1
`risk`	1
`salesforce`	1
`scam`	3
`self`	3
`sender`	7
`sendgrid`	1
`service`	60
`sharepoint`	2
`shipping`	1
`spam`	33
`spoof`	1
`spoofable`	1
`stripe`	1
`subject`	1
`sus`	2
`suspicious`	12
`tax`	2
`unicode`	1
`unrelated`	1
`uri`	1
`urlhaus`	1
`vendor`	1
`venmo`	1
`vip`	14
`wordpress`	2
`xero`	2
`zoom`	2