MITRE ATT&CKsub-technique

T1027.004 Compile After Delivery

Published 2020-03-16 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-03-16

Description

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW. Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (10)

  • G1041 Sea Turtle group
  • S1099 Samurai software (malware)
  • S0673 DarkWatchman software (malware)
  • S0661 FoggyWeb software (malware)
  • S0633 Sliver software (tool)
  • G0106 Rocke group
  • S0385 njRAT software (malware)
  • S0348 Cardinal RAT software (malware)
  • G0069 MuddyWater group
  • G0047 Gamaredon Group group

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-636 Hiding Malicious Data or Code within Files attack pattern

References