← All detection heuristics · Shellcode
critical
SC_MSF_C2
What it means
The Metasploit reverse/bind-TCP connect-back address (host:port) was recovered from the stager's on-stack sockaddr.
Why it fires
Metasploit's block_api stager resolves Win32 APIs by hash and builds a sockaddr_in on the stack before calling connect()/bind(). Static analysis reads that structure directly to surface the C2 endpoint as a network IOC. Recovery is gated on the block_api resolver or a known msf API-hash, so it only fires on genuine stagers. The recovered host is classified as a public (actionable) C2, or a non-routable lab / placeholder / bind-any address (the author's own test environment, not an operational indicator).
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA