Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 285 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 136 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 17 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 225 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 282 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 35 rev 4848 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 22 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 61 rev 4848 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 2 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 70 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 230 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 277 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 20 rev 7763 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 21 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 139 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 5 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 78 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 59 rev 4848 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 285 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 39 rev 4848 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 37 rev 4848 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 3 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 230 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 29 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 275 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 14 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 16 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 220 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 16 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 211 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 279 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 77 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 26 rev 4848 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 131 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 129 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 131 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 79 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 223 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 60 rev 4848 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 289 rev 112154 2026-10-02