tfMITRE ATT&CK sub-technique

Stripped Payloads T1027.008

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Network Devices, Windows
Version: 2.0
Created: 29 September 2022
Last modified: 12 May 2026

Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s linker when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Stripped Payloads MITRE reference T1027.008

51st pctamong all ATT&CK techniques for number of tools

2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Cuckoo StealerS1153 ↗

Is a stripped binary payload.1 2

created 2024-08-20MALWARE

macOS.OSAMinerS1048 ↗

Has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.1

created 2022-10-04MALWARE

All 2 software entries for this technique

Offense vs defense T1027.008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Stripped Payloads detection strategy DET0019

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Stripped Payloads Across Platforms

Enterprise

4 platforms

AN0055 · Windows

Executable or script payloads lacking symbol information and readable strings that are created or dropped by unusual or short-lived processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	EDR:file	File Metadata Inspection (Low String Entropy, Missing PDB)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyThreshold	Payloads with extremely low string entropy may indicate stripped or obfuscated binaries
ParentProcessName	Used to scope or whitelist common system builders, compilers, or admin tools
TimeWindow	Correlates file creation and process spawning within a short timeframe

AN0056 · Linux

Executable or binary files created without symbol tables or with stripped sections, especially by non-user shell processes or compilers invoked outside standard dev paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	EXECVE
File MetadataDC0059	linux:osquery	hash, elf_info, file_metadata
File ModificationDC0061	auditd:SYSCALL	open, write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StripFlags	Flag combinations in compiled binaries indicating symbol table removal
DirectoryScope	Whitelist compiler output directories to reduce false positives
FileSizeRange	Heuristic boundaries for abnormal small or overly large stripped binaries

AN0057 · macOS

Creation of run-only AppleScripts or Mach-O binaries lacking symbol table and string references, especially when dropped by user space scripting engines or staging apps.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
File CreationDC0039	macos:unifiedlog	file write
File MetadataDC0059	macos:osquery	code_signing, file_metadata

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RunOnlyFlag	AppleScript flag to disable reverse engineering (run-only compiled scripts)
ParentProcess	Filter to isolate staging or suspicious scripting engines
SignedStatus	Tuning based on unsigned vs. developer-signed payloads

AN0058 · Network Devices

Inbound binary payloads transferred over HTTP/S with compressed or encoded headers, lacking signature markers or metadata indicative of compiler/toolchain.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	NSM:Flow	http.log, files.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MIMEType	Tune for octet-stream or mismatched Content-Type headers
PayloadSize	Payload threshold for executable-sized artifacts
TransferEncoding	Suspicious base64 or chunked encoding not matching normal app behavior

Stripped Payloads detections T1027.008

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs