AN0055
Analytic 0055
Windows
Executable or script payloads lacking symbol information and readable strings that are created or dropped by unusual or short-lived processes.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
EDR:file
File Metadata Inspection (Low String Entropy, Missing PDB)
[EntropyThreshold]
Payloads with extremely low string entropy may indicate stripped or obfuscated binaries
[ParentProcessName]
Used to scope or whitelist common system builders, compilers, or admin tools
[TimeWindow]
Correlates file creation and process spawning within a short timeframe
AN0056
Analytic 0056
Linux
Executable or binary files created without symbol tables or with stripped sections, especially by non-user shell processes or compilers invoked outside standard dev paths.
auditd:EXECVE
EXECVE
auditd:SYSCALL
open, write
linux:osquery
hash, elf_info, file_metadata
[StripFlags]
Flag combinations in compiled binaries indicating symbol table removal
[DirectoryScope]
Whitelist compiler output directories to reduce false positives
[FileSizeRange]
Heuristic boundaries for abnormal small or overly large stripped binaries
AN0057
Analytic 0057
macOS
Creation of run-only AppleScripts or Mach-O binaries lacking symbol table and string references, especially when dropped by user space scripting engines or staging apps.
macos:unifiedlog
file write
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:osquery
code_signing, file_metadata
[RunOnlyFlag]
AppleScript flag to disable reverse engineering (run-only compiled scripts)
[ParentProcess]
Filter to isolate staging or suspicious scripting engines
[SignedStatus]
Tuning based on unsigned vs. developer-signed payloads
AN0058
Analytic 0058
Network Devices
Inbound binary payloads transferred over HTTP/S with compressed or encoded headers, lacking signature markers or metadata indicative of compiler/toolchain.
NSM:Flow
http.log, files.log
[MIMEType]
Tune for octet-stream or mismatched Content-Type headers
[PayloadSize]
Payload threshold for executable-sized artifacts
[TransferEncoding]
Suspicious base64 or chunked encoding not matching normal app behavior