[Test] Community Spotlight: Email Detection Rules built by the Sublime Community · Blog · Sublime Security

This Sublime blog post highlights community-contributed email detection rules added to its Core Feed, detailing three detection use-cases: detecting Office documents with embedded malicious VSTO add-ins, identifying double Base64-encoded ZIP files smuggled in HTML attachments (used by QakBot), and spotting ROT13-based JavaScript obfuscation in HTML smuggling. The article explains the rule logic and how the community can share and iterate on rules to improve email security.