Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 20 rev 7763 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 18 rev 7763 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 1 rev 4848 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 8 rev 4848 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 16 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 272 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 16 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 269 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 261 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 271 rev 112154 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 17 rev 7763 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 9 rev 4848 2026-10-02
snort ET TOR Known Tor Exit Node TCP Traffic group 100 rev 6395 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 17 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 216 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 2 rev 1747 2026-10-02
snort ET CNC Feodo Tracker Reported CnC Server UDP group 5 rev 8063 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 7 rev 1747 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 6 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 65 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 217 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 63 rev 112154 2026-10-02
snort ET CNC Feodo Tracker Reported CnC Server UDP group 4 rev 8063 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 226 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 66 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 54 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 52 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 215 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 214 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 219 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 6 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 215 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 TCP group 4 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 211 rev 112154 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP TCP group 4 rev 112154 2026-10-02
snort ET Threatview.io High Confidence Cobalt Strike C2 UDP group 21 rev 1747 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 2 rev 112154 2026-10-02
snort ET DROP Spamhaus DROP Listed Traffic Inbound group 47 rev 4848 2026-10-02
snort ET COMPROMISED Known Compromised or Hostile Host Traffic UDP group 20 rev 7763 2026-10-02
snort ET CINS Active Threat Intelligence Poor Reputation IP UDP group 53 rev 112154 2026-10-02