[senderprofile] Attachment Bulk Set 1 by MSAdministrator · Pull Request #3967 · sublime-security/sublime-rules

MSAdministrator · 2026-02-05T15:40:23Z

Description

Removing sender profile from 10 attachment type rules. This is a set of 10 rules

…ment with suspicious link

…licited)

…file scheme link

… text-based file

… image file

… pdf file

…y or attachment with suspicious link

…chive (unsolicited)

…d sender)

…ted)

… file with file scheme link

…itation via text-based file

…itation via image file

…itation via pdf file

MSAdministrator · 2026-02-06T17:02:55Z

    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  and (
-    // exclude solicited senders


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

13 10 3 0.3

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

1 0 2 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

38 31 7 0.2258064516

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

1 0 6 0 0

MSAdministrator · 2026-02-06T17:04:24Z

    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

222 192 30 0.15625

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

8 0 20 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

277 217 60 0.2764976959

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

9 0 47 0 0

MSAdministrator · 2026-02-06T17:05:48Z

                  .depth > 0 and .file_extension in~ ("html", "htm")
          )
  )
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

236 11 225 20.45454545

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 225 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

537 36 501 13.91666667

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 500 0 0

MSAdministrator · 2026-02-06T17:07:35Z

  and any(attachments,
          .file_extension in~ ('htm', 'html') or .file_type == "html"
  )
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

10050 144 9906 68.79166667

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

18 6 9844 7 21

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

30769 329 30440 92.52279635

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

24 21 30325 10 30

MSAdministrator · 2026-02-06T17:09:10Z

  and any(attachments,
          .file_extension in~ ('htm', 'html') or .file_type == "html"
  )
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

9969 228 9741 42.72368421

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

18 12 9679 8 14

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

30757 486 30271 62.28600823

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

25 19 30162 17 19

MSAdministrator · 2026-02-06T17:10:30Z

 source: |
  type.inbound
  and any(attachments, .file_extension == "sap")
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

55 0 55 #DIV/0!

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 55 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

160 0 160 #DIV/0!

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 160 0 0

MSAdministrator · 2026-02-06T17:11:53Z

                  and any(.scan.url.urls, .scheme == "file")
          )
  )
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

236 11 225 20.45454545

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 225 0 0

MSAdministrator · 2026-02-06T17:13:15Z

                  )
          )
  )
-  and profile.by_sender().prevalence != "common"


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

6 5 1 0.2

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 1 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

14 10 4 0.4

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

0 0 4 0 0

MSAdministrator · 2026-02-06T17:14:31Z

 severity: "high"
 source: |
  type.inbound
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

174 127 47 0.3700787402

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

1 1 39 0 5

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

360 264 96 0.3636363636

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

4 1 77 0 13

MSAdministrator · 2026-02-06T17:15:58Z

 severity: "high"
 source: |
  type.inbound
-  and (


06FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

289 130 159 1.223076923

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

3 0 154 0 0

09FEB2026

Total Samples Both Rules Match Gained Detections (new only) % increase

698 262 436 1.664122137

Malicious Gained Suspicious Gained LB Gained Spam Gained Graymail Gained

6 0 428 0 0

MSAdministrator · 2026-02-13T19:22:59Z

Closing these as viable and moving the others to pr #4029

[senderprofile] Attachment Bulk Set 1

b114393

MSAdministrator requested a review from a team February 5, 2026 15:40

MSAdministrator requested a review from a team as a code owner February 5, 2026 15:40

MSAdministrator added the in-test-rules PR is in our testing suite to collect telemetry label Feb 5, 2026

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Adobe image lure in body or attach…

19bd8a8

…ment with suspicious link

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Brand impersonation: Adobe (QR code)

6c5d134

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Any HTML file within archive (unso…

98cc05d

…licited)

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Any HTML file (untrusted sender)

ba51223

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Any HTML file (unsolicited)

6364b50

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Any .sap file (unsolicited)

7a4b45c

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Archive containing HTML file with …

a9838a4

…file scheme link

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Callback phishing solicitation via…

d32335d

… text-based file

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Callback phishing solicitation via…

0f1bb0b

… image file

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: Attachment: Callback phishing solicitation via…

4100885

… pdf file

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Adobe image lure in bod…

eaf841a

…y or attachment with suspicious link

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Brand impersonation: Adobe (QR code)

f2e24bb

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Any HTML file within ar…

62f98c4

…chive (unsolicited)

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Any HTML file (untruste…

9cd543a

…d sender)

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Any HTML file (unsolici…

dfd51ad

…ted)

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Any .sap file (unsolici…

eb24855

…ted)

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Archive containing HTML…

8316edb

… file with file scheme link

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Callback phishing solic…

972f1d3

…itation via text-based file

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Callback phishing solic…

cdf148d

…itation via image file

github-actions Bot added a commit that referenced this pull request Feb 5, 2026

[PR #3967] added rule: PR# 3967 - Attachment: Callback phishing solic…

d1c12e7

…itation via pdf file

MSAdministrator commented Feb 6, 2026

View reviewed changes

MSAdministrator mentioned this pull request Feb 13, 2026

[senderprofile] Attachment Bulk Set 1 #4029

Merged

MSAdministrator closed this Feb 13, 2026

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

cb7f5b0

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

94192b5

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

dfca322

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

1fb5190

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

b1d4d28

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

47e7ca3

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

309e46d

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

a6417ac

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

710d422

github-actions Bot added a commit that referenced this pull request Feb 13, 2026

[Shared Samples] [PR #3967] Delete detection rule

2f97211

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
13	10	3	0.3

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
1	0	2	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
38	31	7	0.2258064516

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
1	0	6	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
222	192	30	0.15625

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
8	0	20	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
277	217	60	0.2764976959

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
9	0	47	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
236	11	225	20.45454545

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
0	0	225	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
537	36	501	13.91666667

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
0	0	500	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
10050	144	9906	68.79166667

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
18	6	9844	7	21

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
30769	329	30440	92.52279635

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
24	21	30325	10	30

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
9969	228	9741	42.72368421

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
18	12	9679	8	14

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
30757	486	30271	62.28600823

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
25	19	30162	17	19

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
55	0	55	#DIV/0!

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
0	0	55	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
174	127	47	0.3700787402

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
1	1	39	0	5

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
360	264	96	0.3636363636

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
4	1	77	0	13

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
289	130	159	1.223076923

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
3	0	154	0	0

Total Samples	Both Rules Match	Gained Detections (new only)	% increase
698	262	436	1.664122137

Malicious Gained	Suspicious Gained	LB Gained	Spam Gained	Graymail Gained
6	0	428	0	0

Conversation

MSAdministrator commented Feb 5, 2026

Description

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MSAdministrator commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant