Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 101 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 149 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 45 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 136 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 147 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 111 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 112 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 18 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 9 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 11 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 94 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 36 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 109 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 136 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 100 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 47 rev 6395 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 48 rev 6395 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 70 rev 6395 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 3 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 114 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 162 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 101 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 125 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 110 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 84 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 81 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 48 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 54 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 22 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 20 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 7 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 125 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 160 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 8 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 4 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 5 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 21 rev 6395 2026-10-02
snort ET DROP Dshield Block Listed Source group 1 rev 7880 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 22 rev 6395 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 50 rev 4848 2026-10-02