Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe[1], csc.exe, or GCC/MinGW.[2]
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.[3]
| ID | Name | Description |
|---|---|---|
| S0348 | Cardinal RAT |
Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.[4] |
| S0673 | DarkWatchman |
DarkWatchman has used the |
| S0661 | FoggyWeb |
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.[6] |
| G0047 | Gamaredon Group |
Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in |
| G0069 | MuddyWater |
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.[2] |
| S0385 | njRAT |
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.[8] |
| G0106 | Rocke |
Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).[9] |
| S1099 | Samurai |
Samurai can compile and execute downloaded modules at runtime.[10] |
| G1041 | Sea Turtle |
Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.[11] |
| S0633 | Sliver |
Sliver includes functionality to retrieve source code and compile locally prior to execution in victim environments.[12] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0501 | Detection Strategy for Compile After Delivery - Source Code to Executable Transformation | AN1381 |
Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries. |
| AN1382 |
Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries. |
||
| AN1383 |
Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder). |