Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Attack Patterns T1027.008 — Stripped Payloads
T1027.008

Stripped Payloads

Stealth
TLP:CLEAR

Description

Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of AppleScript, to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)

MITRE ATT&CK Detection Strategies
1

DET0019 Detection Strategy for Stripped Payloads Across Platforms
AN0057 macOS

Creation of run-only AppleScripts or Mach-O binaries lacking symbol table and string references, especially when dropped by user space scripting engines or staging apps.

macos:unifiedlog macos:endpointsecurity macos:osquery
AN0056 Linux

Executable or binary files created without symbol tables or with stripped sections, especially by non-user shell processes or compilers invoked outside standard dev paths.

auditd:EXECVE auditd:SYSCALL linux:osquery
AN0058 Network Devices

Inbound binary payloads transferred over HTTP/S with compressed or encoded headers, lacking signature markers or metadata indicative of compiler/toolchain.

NSM:Flow
+1 more analytics

Details

Platforms
Linux
Macos
Network devices
Windows
Added
May 2, 2026
Leaving Threaticon

This link opens an external site that isn't part of the platform.