T1027.008 — Stripped Payloads

Tactic: Stealth · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (4)

T1027.008 Obfuscated Files or Information: Stripped Payloads

title: "T1027.008 Obfuscated Files or Information: Stripped Payloads"
id: eb9aa7e3-560c-4c4c-83c7-1e6331558280
description: 'Detects execution of a binary whose PE version-info resource is entirely absent (OriginalFileName, Company, and Description all reported as the Sysmon "-" placeholder), consistent with a fully stripped payload rather than a merely unsigned one. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: EntropyThreshold, ParentProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/008
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.stealth
  - attack.t1027.008

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '.exe'
    OriginalFileName: '-'
    Company: '-'
    Description: '-'

  condition: selection

falsepositives:
  - Some legitimately-stripped or third-party-compiled binaries lack version-info metadata entirely, not just malware; pair with hash reputation and signature-status checks before alerting.

level: informational

T1027.008 Obfuscated Files or Information: Stripped Payloads

title: "T1027.008 Obfuscated Files or Information: Stripped Payloads"
id: 9cb808da-68f5-4445-8da1-806cccf7f9df
description: 'Detection Strategy for Stripped Payloads Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StripFlags, DirectoryScope, FileSizeRange.'
references:
  - https://attack.mitre.org/techniques/T1027/008
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.stealth
  - attack.t1027.008

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/strip'
    a1|contains:
      - '--strip-all'
      - '-s'
  condition: selection

falsepositives:
  - Build systems and packaging scripts commonly strip all symbols from release binaries as standard practice.

level: medium

T1027.008 Obfuscated Files or Information: Stripped Payloads

title: "T1027.008 Obfuscated Files or Information: Stripped Payloads"
id: cd5acf33-7c17-48e2-8036-9653b82c8c53
description: 'Detection Strategy for Stripped Payloads Across Platforms. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RunOnlyFlag, ParentProcess, SignedStatus.'
references:
  - https://attack.mitre.org/techniques/T1027/008
author: Shahrukh Khan
date: 2026-04-05
license: MIT
tags:
  - attack.stealth
  - attack.t1027.008

logsource:
  category: file_event
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/osascript'
  selection_target:
    TargetFilename|contains: '/private/tmp/'
  condition: selection and selection_target

falsepositives:
  - Legitimate installer or update scripts staging executables in temporary directories before code-signature validation.

level: medium

T1027.008 Obfuscated Files or Information: Stripped Payloads

title: "T1027.008 Obfuscated Files or Information: Stripped Payloads"
id: 71a3106c-9497-4876-b14a-f1b6d900f75d
description: 'Detection Strategy for Stripped Payloads Across Platforms. (Data Component: Network Traffic Content; baseline tier: fallback.) Tune using: MIMEType, PayloadSize, TransferEncoding.'
references:
  - https://attack.mitre.org/techniques/T1027/008
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.stealth
  - attack.t1027.008

logsource:
  product: nsm
  service: flow

detection:
  selection_extension:
    uri|endswith:
      - '.jpg'
      - '.png'
      - '.gif'
  selection_encoding:
    method: 'GET'
    status_code: 200
  condition: selection_extension and selection_encoding

falsepositives:
  - Normal image and media downloads make up the vast majority of matches, so this alone is not a reliable indicator without payload content inspection.

level: low

Related sub-techniques

Explore