Skip to content

Pull requests: sublime-security/sublime-rules

New pull request New
75 Open 5,330 Closed
75 Open 5,330 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Create link_monday_hosted_suspicious_content.yml in-test-rules PR is in our testing suite to collect telemetry
#5406 opened Sep 19, 2026 by missingn0pe Member Loading…
Update observed IOC rules - 2026-09-19 shared-samples:excluded:author_membership test-rules:excluded:author_membership
#5405 opened Sep 19, 2026 by github-actions Bot Loading…
1
Metadata only: Consolidate Financial, Consolidate Healthcare
#5404 opened Sep 18, 2026 by randypargman Member Loading…
1
Update link_large_guest_list_sus_link.yml hunting-required Hunts needed to validate rule efficacy test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules
#5402 opened Sep 18, 2026 by D-Bolton Member Loading…
1
Add DLP High Volume rule
#5398 opened Sep 17, 2026 by randypargman Member Loading…
@rw-access @Jummyberry
1
Update impersonation_ms_teams_invite.yml in-test-rules PR is in our testing suite to collect telemetry
#5397 opened Sep 17, 2026 by markmsublime Member Loading…
Create attachment_pdf_w9_signature_reuse.yml in-test-rules PR is in our testing suite to collect telemetry
#5393 opened Sep 17, 2026 by keaton-sublime Member • Draft
Create abuse_filemail_file_share_notification.yml in-test-rules PR is in our testing suite to collect telemetry
#5392 opened Sep 17, 2026 by IndiaAce Member Loading…
Create attachment_meetergo_booking_link.yml in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review
#5386 opened Sep 16, 2026 by missingn0pe Member Loading…
2
Create impersonate_zoho_document_request.yml in-test-rules PR is in our testing suite to collect telemetry
#5377 opened Sep 16, 2026 by IndiaAce Member Loading…
@markmsublime
2
Create attachment_fake_email_body_inline_image.yml in-test-rules PR is in our testing suite to collect telemetry
#5376 opened Sep 16, 2026 by IndiaAce Member Loading…
Create impersonate_microsoft_document_share_pdf.yml in-test-rules PR is in our testing suite to collect telemetry
#5375 opened Sep 16, 2026 by IndiaAce Member Loading…
Add beta DLP rule stubs for EU driver's licenses (DE, PL, NL, GR, FI) review-needed Indicates that a PR is waiting for review shared-samples:excluded:author_membership
#5374 opened Sep 16, 2026 by Jummyberry Contributor • Draft
1
Create link_disguised_as_pdf.yml in-test-rules PR is in our testing suite to collect telemetry
#5373 opened Sep 16, 2026 by keaton-sublime Member • Draft
Enhance description for Australia ABN detection rule
#5369 opened Sep 15, 2026 by randypargman Member Loading…
@Jummyberry
Add beta DLP rules for Spain and Sweden driver's licenses review-needed Indicates that a PR is waiting for review shared-samples:excluded:author_membership test-rules:excluded:author_membership
#5368 opened Sep 15, 2026 by Jummyberry Contributor Loading…
1
Create attachment_pdf_base64_query_parameter.yml in-test-rules PR is in our testing suite to collect telemetry
#5365 opened Sep 15, 2026 by D-Bolton Member Loading…
add strings.decode_hex to multiple rules hunting-required Hunts needed to validate rule efficacy review-needed Indicates that a PR is waiting for review test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules test-rules:excluded:manual Manually excluded from test-rules, either by adding this label or removing the in-test-rules label
#5362 opened Sep 15, 2026 by zoomequipd Member Loading…
@IndiaAce
2
Create link_job_payment_signature_request.yml in-test-rules PR is in our testing suite to collect telemetry
#5346 opened Sep 14, 2026 by keaton-sublime Member • Draft
Create body_bid_solicitation_pdf_lure.yml in-test-rules PR is in our testing suite to collect telemetry
#5339 opened Sep 14, 2026 by keaton-sublime Member • Draft
Rename Fuzzy Attack Score on Graymail
#5332 opened Sep 11, 2026 by dlynch-sublime Member • Draft
Add beta DLP rule for MSIP sensitivity label outbound detection review-needed Indicates that a PR is waiting for review shared-samples:excluded:author_membership test-rules:excluded:author_membership
#5330 opened Sep 11, 2026 by Jummyberry Contributor Loading…
1
Update and rename attachment_pdf_obj_hash_cred_phish.yml to pdf_objec… in-test-rules PR is in our testing suite to collect telemetry
#5329 opened Sep 11, 2026 by keaton-sublime Member Loading…
Refine attachment checks in mobile solicitation rule in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review
#5326 opened Sep 10, 2026 by randypargman Member Loading…
@markmsublime
3
Update BEC rule to match intent of no attachments other than banners in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review
#5325 opened Sep 10, 2026 by randypargman Member Loading…
@markmsublime
3
ProTip! Adding no:label will show everything without a label.