Compile After Delivery
Parent: T1027
Description
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Mapped SPARTA techniques
No techniques mapped to this control.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Countered by 15 in MITRE D3FEND (Defensive Techniques)
- D3-CFContent Filtering
- D3-CMContent Modification
- D3-CQContent Quarantine
- D3-DADynamic Analysis
- D3-DFDecoy File
- D3-EALExecutable Allowlisting
- D3-EDLExecutable Denylisting
- D3-EFAEmulated File Analysis
- D3-FAFile Analysis
- D3-FEFile Encryption
- D3-FEVFile Eviction
- D3-FIMFile Integrity Monitoring
- D3-LFPLocal File Permissions
- D3-RFRestore File
- D3-RFAMRemote File Access Mediation
Cite as SafeMode Space, mitre-attack-enterprise T1027.004.