Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.004sub-technique of T1027 Obfuscated Files or Information

Compile After Delivery

Linux · macOS · Windowsnothing on this site yetT1027.004 on attack.mitre.org

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Compile After Delivery - Source Code to Executable Transformation

  • Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries.
  • Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries.
  • Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder).

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.