YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]
Critical
- Category
- YARA Match
- Content
#!/usr/bin/env python3 """CVE Correlator — threat intelligence & vulnerability database correlation (v3.0.0). Correlates discovered technologies and versions with known CVEs from the NVD (National Vulnerability Database) and other sources. Provides: 1. CPE-to-CVE mapping based on technology fingerprinting 2. Severity-prioritized CVE listing (CVSS v3 scores) 3. Exploit availability check (Metasploit, ExploitDB, PoC references) 4. Remediation guidance (patch versions, workarounds) 5. Risk scoring integration with the main pipeline This module is deterministic: it takes technology fingerprints and returns a structured CVE report. It includes a built-in CVE knowledge base for common web frameworks and middleware. Usage (CLI): python cve_correlator.py --technologies tech.json python cve_correlator.py --cpe "cpe:/a:apache:struts:2.5.26" python cve_correlator.py --batch targets.json """ from __future__ import annotations import argparse import json import re import sys
- Confidence
- 85% confidence
- Finding
- YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).