T1027.004 Compile After Delivery
sub-techniqueEnterpriseAdversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW. Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
detected by (3)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Detect
Isolate
Deceive
Restore
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (4)
Threat groups associated with this.
software (6)
Malware and tools associated with this.
Detected by (Sigma) (6)
Sigma detection rules related to this.
source
Where this definition is published.