| name | T1027.004_compile-after-delivery |
| description | Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1027.004","defense-evasion","linux","macos","windows","sub-technique"] |
| technique_id | T1027.004 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1027/004 |
| tech_stack | ["linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1027","T1027.001","T1027.002","T1027.003","T1027.005","T1027.006","T1027.007","T1027.008","T1027.009","T1027.010","T1027.011","T1027.012","T1027.013","T1027.014","T1027.015","T1027.016","T1027.017"] |
| prerequisites | ["T1027"] |
| severity_boost | {"T1027":"Chain with T1027 for deeper attack path","T1027.001":"Chain with T1027.001 for deeper attack path","T1027.002":"Chain with T1027.002 for deeper attack path"} |
T1027.004 Compile After Delivery
Sub-technique of: T1027
High-Level Description
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.
Kill Chain Phase
Platforms: Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Compile After Delivery using csc.exe
Compile C# code using csc.exe binary used by .NET
Upon execution an exe named T1027.004.exe will be placed in the temp folder
Supported Platforms: windows
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} "#{input_file}"
Dependencies:
- C# file must exist on disk at specified location (#{input_file})
Atomic Test 2: Dynamic C# Compile
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution.
The exe file that will be executed is named as T1027.004_DynamicCompile.exe is contained in the 'bin' folder of this atomic, and the source code to the file is in the 'src' folder.
Upon execution, the exe will print 'T1027.004 Dynamic Compile'.
