Obfuscated Files or Information: Compile After Delivery

Created the Wednesday 15 February 2023. Updated 1 year, 2 months ago.

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.

Technique Identifier

T1027.004

Technique Tags

Defense Evasion uncompiled code compile malicious code execute malicious code encrypted malicious code

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Obfuscated Files or Information: Compile After Delivery, Sub-technique T1027.004 - Enterprise | MITRE ATT&CK®