T1027.004Stealth
Compile After Delivery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW. Source code payloads may also…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1027.004Compile After DeliveryT1027.0046 general rules
- Csc.EXE Execution Form Potentially Suspicious Parenthightest
- Visual Basic Command Line Compiler Usagehightest
- Dynamic .NET Compilation Via Csc.EXEmediumtest
- Dynamic .NET Compilation Via Csc.EXE - Huntingmediumtest
- Potential Application Whitelisting Bypass via Dnx.EXEmediumtest
- Dynamic CSharp Compile Artefactlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Compile After Delivery
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.