Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 166 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 159 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 20 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 241 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 93 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 21 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 238 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 239 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 237 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 18 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 77 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 78 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 157 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 95 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 160 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 242 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 20 rev 7763 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 19 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 277 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 203 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 206 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 12 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 20 rev 1747 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 130 rev 6395 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 7 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 4 rev 1747 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 62 rev 6395 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 66 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 272 rev 112154 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 67 rev 6395 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 61 rev 6395 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 55 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 201 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 19 rev 1747 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 25 rev 6395 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 187 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 17 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 18 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 15 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 14 rev 1747 2026-10-02