diff --git a/syntax_files/netstat.yaml b/syntax_files/netstat.yaml
new file mode 100644
index 0000000..5b70ee4
--- /dev/null
+++ b/syntax_files/netstat.yaml
@@ -0,0 +1,30 @@
+filetype: netstat
+
+detect: 
+    filename: "\\.netstat$"
+    header: "(^Active Internet connections|\\sRecv-Q\\sSend-Q\\sLocal Address)"
+
+rules:
+    # Scan Title
+    - magenta: "\\sRecv-Q\\sSend-Q\\sLocal Address.*"
+    # IP
+    - yellow: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
+    # Ports
+    - green: "^(\\d+)"
+    - red: "(\\s+\\d+)/(\\w+).*"
+    - red: "users:\\(\\(\"[a-zA-Z.0-9-]+\",pid=\\d+,fd=\\d+\\).*"
+    - magenta: "\\s+([a-zA-Z-]+)$"
+    # Ports Details
+    - yellow: "^\\|_?(.*)"
+    - yellow: "(Service Info|OS details|Device type|Running):\\s.*$"
+    - constant.number: "(\\b[0-9.]+\\b|\\b0x[0-9A-Fa-f]+\\b)([ms|s|seconds])?(\\s+|$)"
+    - yellow: "\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}(:\\d{2})?"
+    - yellow: "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}"
+    # hostname
+    - yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"
+    - green: "(tcp)(6)?"
+    - yellow: "(unix|udp(6)?)"
+    - green: "(CONNECTED|ESTABLISHED|LISTEN)"
+    - red: "\\s+SYN_SENT"
+    - yellow: "pid=\\d+"
+    - green: "\"[a-zA-Z.0-9-]+\""
diff --git a/syntax_files/nmap.yaml b/syntax_files/nmap.yaml
index 1dd185a..5b66794 100644
--- a/syntax_files/nmap.yaml
+++ b/syntax_files/nmap.yaml
@@ -13,10 +13,6 @@ rules:
     - red: "Failed\\sto\\sresolve\\s\"(\\S+)\""
     # IP
     - yellow: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
-    # IP v6
-    - yellow: "(([0-9a-fA-F]{1,4})?\\:\\:?[0-9a-fA-F]{1,4})+"
-    # hostname
-    - yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"
     # Ports
     - green: "^(\\d+)"
     - red: "/(\\w+)\\s+(\\w+)\\s+(\\S+)"
@@ -33,7 +29,11 @@ rules:
     - yellow: "\\sfiltered\\s"
     - red: "\\sclosed\\s"
     - cyan: "\\sunfiltered\\s"
-    - constant.number: "(\\b[0-9.]+\\b|\\b0x[0-9A-Fa-f]+\\b)([ms|s|seconds])?(\\s+|$)"
-    - yellow: "\\d{1,4}-\\d{1,2}-\\d{1,2}\\s\\d{1,2}:\\d{1,2}"
+    - yellow: "(Service Info|OS details|Device type|Running):\\s.*$"
     # Closed ports
     - red: "Not shown: (\\d+)\\s(closed|filtered)\\sports"
+    - constant.number: "(\\b[0-9.]+\\b|\\b0x[0-9A-Fa-f]+\\b)([ms|s|seconds])?(\\s+|$)"
+    - yellow: "\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}(:\\d{2})?"
+    - yellow: "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}"
+    # hostname
+    - yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"