Cross-source coverage
T1500 / ATT&CK
Compile After Delivery
ATT&CK has retired this technique. Rules still tag it; the current id is T1027.004 Obfuscated Files or Information: Compile After Delivery.
From MITRE ATT&CK 19.2
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to Obfuscated Files or Information, text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Spearphishing Attachment. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
- —
socfortress/Wazuh-Rules
2 rules · 1 family| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · Compile After Delivery (T1500) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · Compile After Delivery (T1500) 2 variants | Low | Wazuh XML |