Metasploit stager C2 recovered

SC_MSF_C2

← All detection heuristics · Shellcode

critical SC_MSF_C2

What it means

The Metasploit reverse/bind-TCP connect-back address (host:port) was recovered from the stager's on-stack sockaddr.

Why it fires

Metasploit's block_api stager resolves Win32 APIs by hash and builds a sockaddr_in on the stack before calling connect()/bind(). Static analysis reads that structure directly to surface the C2 endpoint as a network IOC. Recovery is gated on the block_api resolver or a known msf API-hash, so it only fires on genuine stagers. The recovered host is classified as a public (actionable) C2, or a non-routable lab / placeholder / bind-any address (the author's own test environment, not an operational indicator).

Other Shellcode heuristics

SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD SC_STR_MSHTA