← All detection heuristics · Shellcode
medium
SC_PUSH_STRING
What it means
Two or more consecutive PUSH imm32 instructions whose decoded bytes spell a Windows API or shell-keyword string.
Why it fires
Shellcode frequently constructs strings (like 'cmd.exe' or 'WinExec') on the stack by pushing 4-byte immediates with the 0x68 opcode. The rule matches a run of ≥2 PUSH imm32 instructions and only fires when the decoded bytes contain a known execution, network, or Windows API keyword — so generic numeric pushes do not trigger it.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_CMD