Compile After Delivery

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to Obfuscated Files or Information, text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.[1]

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Spearphishing Attachment. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.[2]

ID: T1500

Tactic: Defense Evasion

Platform:  Linux, macOS, Windows

System Requirements:  Compiler software (either native to the system or delivered by the adversary)

Permissions Required:  User

Data Sources:  Process command-line parameters, Process monitoring, File monitoring

Defense Bypassed:  Static File Analysis, Binary Analysis, Anti-virus, Host intrusion prevention systems, Signature-based detection

Contributors:  Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank; Praetorian

Version: 1.0

Examples

NameDescription
Cardinal RAT

Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.[3]

MuddyWater

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.[1]

Mitigation

This type of technique cannot be easily mitigated with preventive controls or patched since it is based on the abuse of operating system design features. For example, blocking all file compilation may have unintended side effects, such as preventing legitimate OS frameworks and code development mechanisms from operating properly. Consider removing compilers if not needed, otherwise efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior.

Identify unnecessary system utilities or potentially malicious software that may be used to decrypt, deobfuscate, decode, and compile files or information, and audit and/or block them by using whitelisting [4] tools, like AppLocker, [5] [6] or Software Restriction Policies [7] where appropriate. [8]

Detection

Monitor the execution file paths and command-line arguments for common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. The compilation of payloads may also generate file creation and/or file write events. Look for non-native binary formats and cross-platform compiler and execution frameworks like Mono and determine if they have a legitimate purpose on the system.[2] Typically these should only be used in specific and limited cases, like for software development.

References