Here’s a proof-of-concept YARA rule that matches stack string creation in x86/x64 binaries/shellcode: https://gist.github.com/williballenthin/ed7b3de224d5b986bc04dc882c5ee7c5