Symbol stripping run against a compiled binary on Linux

Siemphony@siemphonylowT1027.008unverifiedPlaybook · Defence evasion

The observable this technique is named for is a property of a *file* — no symbol table, no readable strings — and no log source in this brief carries it. Sysmon EventID 1 emits Image, CommandLine and Hashes, EventID 11 emits TargetFilename and the writing process, and Zeek http.log and files.log emit MIME type and size; none of them records whether a binary has a .symtab section, and MITRE's `EntropyThreshold` knob is not a field on any of them. So this rule takes the Linux leg of AN0056 and matches the stripping *act* instead of the stripped artefact: an execution of the binutils strip tool, an objcopy invocation carrying one of the flags that removes symbols, or a Go build whose linker flags discard the symbol table and DWARF data. That is MITRE's `StripFlags` knob — flag combinations indicating symbol table removal — populated here with those specific tools and switches rather than taken from MITRE. Because `endswith` anchors on the tail of the path, the tool list carries both `/strip` and `-strip`, so the prefixed builds of the same binary that are what is actually installed on many hosts — `llvm-strip`, `eu-strip`, `x86_64-linux-gnu-strip`, `aarch64-linux-gnu-strip` — are covered as well as a bare `strip`. Three limits are structural and none of them is fixable from this source. Stripping is overwhelmingly done on the adversary's build host before delivery, or inside a compiler the victim never runs, so the common case produces no event on the victim at all — this rule sees only the unusual case where the payload is built or post-processed in place. `gcc -s` and `ld -s` are deliberately absent: compiler binaries are version-suffixed and target-prefixed (`gcc-12`, `x86_64-linux-gnu-gcc-12`), which defeats an `endswith` on `/gcc`, and a bare ` -s ` on a compiler command line is not specific enough to carry the rule on its own. Packers are also out of scope by design — a UPX-compressed payload is T1027.002, not this. The other three analytics under DET0019 are not attempted: AN0055 (Windows) and AN0058 (network) have no field for symbols or strings as described above, and AN0057 (macOS), whose real observable is a run-only AppleScript produced by `osacompile -x`, offers only unifiedlog, EndpointSecurity and osquery, none of which has a standardised Sigma field vocabulary — inventing one would produce a rule that parses, renders in four backends and matches nothing. Vocabulary and prerequisite: this rule is written in the Sysmon-for-Linux shaped `process_creation` vocabulary (Image, CommandLine) that the brief maps `auditd:EXECVE::EXECVE` onto. Raw auditd carries the same values as `exe=` on the SYSCALL record and `a0`..`aN` on a separate EXECVE record, so that feed needs a field mapping before this rule applies to it, and auditd records no execve at all until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded. Until one is, this rule returns zero rows, and zero rows here means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0019, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Symbol stripping run against a compiled binary on Linux2id: cc4c67e1-fdc9-4074-9cdc-950b0ac78ad03status: experimental4description: |5  The observable this technique is named for is a property of a *file* — no6  symbol table, no readable strings — and no log source in this brief carries7  it. Sysmon EventID 1 emits Image, CommandLine and Hashes, EventID 11 emits8  TargetFilename and the writing process, and Zeek http.log and files.log emit9  MIME type and size; none of them records whether a binary has a .symtab10  section, and MITRE's `EntropyThreshold` knob is not a field on any of them.11  So this rule takes the Linux leg of AN0056 and matches the stripping *act*12  instead of the stripped artefact: an execution of the binutils strip tool, an13  objcopy invocation carrying one of the flags that removes symbols, or a Go14  build whose linker flags discard the symbol table and DWARF data. That is15  MITRE's `StripFlags` knob — flag combinations indicating symbol table16  removal — populated here with those specific tools and switches rather than17  taken from MITRE. Because `endswith` anchors on the tail of the path, the18  tool list carries both `/strip` and `-strip`, so the prefixed builds of the19  same binary that are what is actually installed on many hosts —20  `llvm-strip`, `eu-strip`, `x86_64-linux-gnu-strip`, `aarch64-linux-gnu-strip`21  — are covered as well as a bare `strip`.22  Three limits are structural and none of them is fixable from this source.23  Stripping is overwhelmingly done on the adversary's build host before24  delivery, or inside a compiler the victim never runs, so the common case25  produces no event on the victim at all — this rule sees only the unusual26  case where the payload is built or post-processed in place. `gcc -s` and27  `ld -s` are deliberately absent: compiler binaries are version-suffixed and28  target-prefixed (`gcc-12`, `x86_64-linux-gnu-gcc-12`), which defeats an29  `endswith` on `/gcc`, and a bare ` -s ` on a compiler command line is not30  specific enough to carry the rule on its own. Packers are also out of scope31  by design — a UPX-compressed payload is T1027.002, not this. The other three32  analytics under DET0019 are not attempted: AN0055 (Windows) and AN005833  (network) have no field for symbols or strings as described above, and AN005734  (macOS), whose real observable is a run-only AppleScript produced by35  `osacompile -x`, offers only unifiedlog, EndpointSecurity and osquery, none36  of which has a standardised Sigma field vocabulary — inventing one would37  produce a rule that parses, renders in four backends and matches nothing.38  Vocabulary and prerequisite: this rule is written in the Sysmon-for-Linux39  shaped `process_creation` vocabulary (Image, CommandLine) that the brief maps40  `auditd:EXECVE::EXECVE` onto. Raw auditd carries the same values as `exe=` on41  the SYSCALL record and `a0`..`aN` on a separate EXECVE record, so that feed42  needs a field mapping before this rule applies to it, and auditd records no43  execve at all until a rule such as44  `-a always,exit -F arch=b64 -S execve -k exec` is loaded. Until one is, this45  rule returns zero rows, and zero rows here means blind rather than quiet.46  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0019, not hand-written and not tested by its author. Any lab result is on this rule's own page.47references:48  - https://attack.mitre.org/techniques/T1027/00849  - https://attack.mitre.org/detectionstrategies/DET001950author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)51date: 2026-08-1752tags:53  - attack.defense-evasion54  - attack.t1027.00855logsource:56  category: process_creation57  product: linux58detection:59  selection_strip:60    Image|endswith:61      - '/strip'62      - '-strip'63      - '/sstrip'64  selection_objcopy:65    Image|endswith:66      - '/objcopy'67      - '-objcopy'68    CommandLine|contains:69      - '--strip-all'70      - '--strip-debug'71      - '--strip-unneeded'72      - '--strip-symbol'73      - '--discard-all'74  selection_go_build:75    Image|endswith: '/go'76    CommandLine|contains: '-ldflags'77  selection_go_stripflags:78    CommandLine|contains:79      - '-s -w'80      - '-w -s'81  condition: selection_strip or selection_objcopy or (selection_go_build and selection_go_stripflags)82falsepositives:83  - "Ordinary software packaging. Debian helper dh_strip and the RPM find-debuginfo pass run strip or objcopy over every binary and shared object in a package, which is hundreds of executions per build, and make install-strip does the same for hand-built software. On any build server, CI runner or developer workstation this is the dominant match by a very wide margin, and it is why the level is low rather than medium."84  - "Separate-debuginfo workflows, where the standard recipe is objcopy --only-keep-debug, then objcopy --strip-debug, then objcopy --add-gnu-debuglink. Distribution build systems, Yocto and Buildroot images, and crash-reporting toolchains all run that sequence on every artefact they produce."85  - "Go release builds. Passing -ldflags with -s and -w is the documented way to shrink a Go binary, so it appears in the Makefile, goreleaser config or Dockerfile of a large share of Go projects and fires on every build and every container image rebuild."86  - "Kernel and out-of-tree module installation. make modules_install strips debug information from every .ko when INSTALL_MOD_STRIP is set, and DKMS repeats it for third-party drivers after each kernel upgrade."87  - "Embedded and appliance image builds that strip binaries purely to fit a size budget, including cross-compiled firmware trees where the tool that runs is a target-prefixed strip such as arm-linux-gnueabihf-strip."88level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/strip" or FolderPath endswith "-strip" or FolderPath endswith "/sstrip") or ((FolderPath endswith "/objcopy" or FolderPath endswith "-objcopy") and (ProcessCommandLine contains "--strip-all" or ProcessCommandLine contains "--strip-debug" or ProcessCommandLine contains "--strip-unneeded" or ProcessCommandLine contains "--strip-symbol" or ProcessCommandLine contains "--discard-all"))) or ((FolderPath endswith "/go" and ProcessCommandLine contains "-ldflags") and (ProcessCommandLine contains "-s -w" or ProcessCommandLine contains "-w -s")))

Splunk · SPL

Run this as a search.

index=* (((Image="*/strip" OR Image="*-strip" OR Image="*/sstrip") OR ((Image="*/objcopy" OR Image="*-objcopy") AND (CommandLine="*--strip-all*" OR CommandLine="*--strip-debug*" OR CommandLine="*--strip-unneeded*" OR CommandLine="*--strip-symbol*" OR CommandLine="*--discard-all*"))) OR ((Image="*/go" AND CommandLine="*-ldflags*") AND (CommandLine="*-s -w*" OR CommandLine="*-w -s*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/strip" OR TO_LOWER(process.executable) LIKE "*-strip" OR TO_LOWER(process.executable) LIKE "*/sstrip") OR ((TO_LOWER(process.executable) LIKE "*/objcopy" OR TO_LOWER(process.executable) LIKE "*-objcopy") AND (TO_LOWER(process.command_line) LIKE "*--strip-all*" OR TO_LOWER(process.command_line) LIKE "*--strip-debug*" OR TO_LOWER(process.command_line) LIKE "*--strip-unneeded*" OR TO_LOWER(process.command_line) LIKE "*--strip-symbol*" OR TO_LOWER(process.command_line) LIKE "*--discard-all*"))) OR ((TO_LOWER(process.executable) LIKE "*/go" AND TO_LOWER(process.command_line) LIKE "*-ldflags*") AND (TO_LOWER(process.command_line) LIKE "*-s -w*" OR TO_LOWER(process.command_line) LIKE "*-w -s*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/strip$|-strip$|/sstrip$)</field>    <description>Symbol stripping run against a compiled binary on Linux (1/3)</description>    <mitre>      <id>T1027.008</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/objcopy$|-objcopy$)</field>    <field name="CommandLine" type="pcre2">(?i)(--strip-all|--strip-debug|--strip-unneeded|--strip-symbol|--discard-all)</field>    <description>Symbol stripping run against a compiled binary on Linux (2/3)</description>    <mitre>      <id>T1027.008</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/go$</field>    <field name="CommandLine" type="pcre2">(?i)-ldflags</field>    <field name="CommandLine" type="pcre2">(?i)(-s -w|-w -s)</field>    <description>Symbol stripping run against a compiled binary on Linux (3/3)</description>    <mitre>      <id>T1027.008</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: cc4c67e1-fdc9-4074-9cdc-950b0ac78ad0

ATT&CKT1027.008

T1027.008Stripped Payloads

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.008, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope by host class first. On a CI runner this is unusable as an alert; on a
Use MITRE's DirectoryScope knob as intended — exclude compiler output
If you can absorb the noise, add a third Go term matching -s and -w
Do not stretch this to packers; a UPX-compressed payload is T1027.002.

Declared by the author

Ordinary software packaging. Debian helper dh_strip and the RPM find-debuginfo pass run strip or objcopy over every binary and shared object in a package, which is hundreds of executions per build, and make install-strip does the same for hand-built software. On any build server, CI runner or developer workstation this is the dominant match by a very wide margin, and it is why the level is low rather than medium.
Separate-debuginfo workflows, where the standard recipe is objcopy --only-keep-debug, then objcopy --strip-debug, then objcopy --add-gnu-debuglink. Distribution build systems, Yocto and Buildroot images, and crash-reporting toolchains all run that sequence on every artefact they produce.
Go release builds. Passing -ldflags with -s and -w is the documented way to shrink a Go binary, so it appears in the Makefile, goreleaser config or Dockerfile of a large share of Go projects and fires on every build and every container image rebuild.
Kernel and out-of-tree module installation. make modules_install strips debug information from every .ko when INSTALL_MOD_STRIP is set, and DKMS repeats it for third-party drivers after each kernel upgrade.
Embedded and appliance image builds that strip binaries purely to fit a size budget, including cross-compiled firmware trees where the tool that runs is a target-prefixed strip such as arm-linux-gnueabihf-strip.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

AN0056's observable is a property of a file: an ELF with no symbol table and no readable strings. Nothing in the brief exposes that in a Sigma-addressable way — Sysmon EID 1 gives Image/CommandLine/Hashes, EID 11 gives TargetFilename, Zeek gives MIME type and size. The osquery leg (elf_info, elf_sections) genuinely holds the data, but lib/sigma has no field vocabulary for product: linux / service: osquery, so any field name would be invented. The rule therefore matches the act of stripping instead of the stripped artefact. Size that before deploying: it is a build-host observable. Adversaries strip on their own machine before delivery, so on an ordinary endpoint fleet the realistic matching population is developer and packaging activity only. It earns its place where compilation is itself anomalous.

02 · Telemetry you need

category: process_creation / product: linux, verbatim from AN0056, in the Sysmon-for-Linux vocabulary the brief maps auditd:EXECVE onto. All four backends render. On raw auditd the same values sit in exe= on SYSCALL and a0..aN on a separate EXECVE record, so that feed needs a field mapping first — and auditd emits no execve until a rule such as -a always,exit -F arch=b64 -S execve -k exec is loaded. Zero rows there means blind, not quiet.

03 · How the logic works

selection_strip or selection_objcopy or (selection_go_build and selection_go_stripflags). selection_strip is Image|endswith on /strip, -strip, /sstrip. The -strip entry is load-bearing: endswith anchors on the tail of the path, and what is actually installed on most hosts is llvm-strip, eu-strip or x86_64-linux-gnu-strip, none of which ends in /strip. selection_objcopy ANDs the binary against --strip-all, --strip-debug, --strip-unneeded, --strip-symbol, --discard-all, because objcopy alone is an ordinary object-file operation. The Go arm needs -ldflags on the command line and -s -w or -w -s as a substring. Two gaps follow from the substring form: flags exported through GOFLAGS never reach argv, and -ldflags="-s -X main.version=1 -w" separates the pair so neither literal matches. This is MITRE's StripFlags knob populated with authored values — MITRE names the knob, not these binaries. Its EntropyThreshold and FileSizeRange knobs have no corresponding field on this source at all. gcc -s is deliberately absent: compilers are version-suffixed (gcc-12), which defeats endswith.

04 · Common false positives

Almost entirely from packaging. Debian's dh_strip and the RPM find-debuginfo pass run strip or objcopy over every binary in a package — hundreds of executions per build. Separate-debuginfo recipes chain --only-keep-debug, --strip-debug, --add-gnu-debuglink on every artefact. Go release builds pass -s -w as documented practice, so goreleaser and container rebuilds fire every time. make modules_install with INSTALL_MOD_STRIP, and DKMS after each kernel upgrade, do it again. The level is low because the top false positive is the dominant match by a wide margin.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. The reasoning that llvm-strip matches and gcc-12 does not is paper analysis, not evidence, and it says nothing about volume.
tier_2: is a fortnight read-only, ranking hits by Image and parent to learn how much of the estate compiles software.
tier_3: is the correlation this single-event form cannot reach: a strip or Go build followed by the stripped artefact executing from a non-standard path.

Share this rule

/u/siemphony/cc4c67e1-fdc9-4074-9cdc-950b0ac78ad0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Symbol stripping run against a compiled binary on Linux

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it