Developers leave helpful labels in code: variable names, function names, readable strings. Attackers strip those out so that anyone analyzing the payload has far less to go on.
MITRE tracks this as Stripped Payloads, technique T1027.008, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS, Network Devices and Windows.
How attackers use it
Compiled executables carry symbols generated by the linker, and both scripts and executables contain strings that explain what the code does. Reverse engineers rely on both. Compilers and other tools can remove or obfuscate them. MITRE also names run-only AppleScripts, a compiled and stripped form of AppleScript, as an example of a stripped payload format used to avoid analysis.
The absence of readable information directly slows detection and analysis.
How to detect it
MITRE's strategy (DET0019) gives four analytics. They share a theme: look at where the file came from, because the file itself says little.
- Executable or script payloads with no symbols and no readable strings, created by unusual or short-lived processes.
- Binaries with no symbol tables or stripped sections, created by non-user shell processes or compilers run outside standard development paths.
- Run-only AppleScripts or Mach-O binaries with no symbol table, dropped by scripting engines or staging apps.
- Inbound binary payloads over HTTP or HTTPS with compressed or encoded headers and no metadata that points to a compiler or toolchain.
Stripped binaries are normal in commercial software, so the file alone is not the alert. A stripped binary written by a script a minute ago into a temp folder is.
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. Focus on provenance and behavior: where did this file come from, and what is it doing? Application control and endpoint behavior detection carry most of the weight.
Quick check
Why is a stripped binary not suspicious by itself?
Many legitimate products ship stripped. The signal comes from context: a short-lived or unusual process wrote it, it appeared outside development paths or it arrived with no toolchain metadata.
Sources
- MITRE ATT&CK, Stripped Payloads (T1027.008)
