Cross-source coverage

T1027.004 / ATT&CK

Obfuscated Files or Information: Compile After Delivery

14 rules across 6 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonauditd:SYSCALLNSM:Flowmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0501

Detection Strategy for Compile After Delivery - Source Code to Executable Transformation

Windows Analytic 1381

Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 1382

Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open,create
  • NSM:Flow conn.log

macOS Analytic 1383

Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder).

  • macos:unifiedlog process activity, exec events
  • macos:osquery file_events
  • macos:unifiedlog networkd or socket

View on attack.mitre.org ↗

SigmaHQ/sigma

6 rules
Detection Severity Format
Csc.EXE Execution Form Potentially Suspicious Parent High Sigma
Visual Basic Command Line Compiler Usage High Sigma
Dynamic .NET Compilation Via Csc.EXE Medium Sigma
Dynamic .NET Compilation Via Csc.EXE - Hunting Medium Sigma
Potential Application Whitelisting Bypass via Dnx.EXE Medium Sigma
Dynamic CSharp Compile Artefact Low Sigma

elastic/detection-rules

3 rules
Detection Severity Format
GenAI Process Compiling or Generating Executables Medium Elastic TOML
Suspicious .NET Code Compilation Medium Elastic TOML
Microsoft Build Engine Started an Unusual Process Low Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
CSC Net On The Fly Compilation Undefined SPL
Linux Suspicious GCC Invocation Building Init Shared Object Undefined SPL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell script compiling code using CSC.exe, possible malware drop Medium Wazuh XML

elastic/protections-artifacts

1 rule
Detection Severity Format
Linux Compilation in Suspicious Directory Undefined Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Compilation tool execution detected (gcc, g++, clang, clang++, go) - potential Compile After Delivery High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.