{"id":"T1027.004","name":"Compile After Delivery","url":"https://attack.mitre.org/techniques/T1027/004","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0501","stix_id":"x-mitre-detection-strategy--48d80184-842f-419a-ab84-01030f866bd4","name":"Detection Strategy for Compile After Delivery - Source Code to Executable Transformation","url":"https://attack.mitre.org/detectionstrategies/DET0501","analytics":[{"id":"AN1381","stix_id":"x-mitre-analytic--3cd889a5-7955-4d38-a49b-89e8d276ceab","name":"Analytic 1381","description":"Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0501#AN1381","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessName","description":"Filter for unexpected users (non-dev) launching compilers like csc.exe or msbuild.exe"},{"field":"OutputDirectoryPath","description":"Adjust paths for sensitive file write zones (e.g., `C:\\Users\\Public\\`, `%TEMP%`, or Desktop)"},{"field":"TimeWindow","description":"Tune the correlation window between compilation and subsequent execution or C2"}],"live":true,"detection_strategies":["DET0501"],"techniques":["T1027.004"]},{"id":"AN1382","stix_id":"x-mitre-analytic--774d555e-b94b-4dbd-bc3b-fb60d55e6e2d","name":"Analytic 1382","description":"Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0501#AN1382","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open,create","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"conn.log","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CompilerBinaryPath","description":"Specify path and binaries for detection (e.g., `/usr/bin/gcc`, `/opt/mingw/bin/gcc`)"},{"field":"FilePermissionProfile","description":"Match uncommon chmod behavior post-compilation (e.g., +x in `/tmp` or home directories)"}],"live":true,"detection_strategies":["DET0501"],"techniques":["T1027.004"]},{"id":"AN1383","stix_id":"x-mitre-analytic--56a814a9-2b6b-4fcc-a530-e9ca62faaa17","name":"Analytic 1383","description":"Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder).","url":"https://attack.mitre.org/detectionstrategies/DET0501#AN1383","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process activity, exec events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"file_events","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"networkd or socket","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CompilerInvocationPattern","description":"Detect calls to `xcodebuild`, `clang`, or `/Applications/Mono.app/...` from non-admin users"},{"field":"OutputBinaryPath","description":"Monitor for output files in user-writable paths (e.g., `~/Library/Caches`, `~/Downloads`)"}],"live":true,"detection_strategies":["DET0501"],"techniques":["T1027.004"]}],"live":true,"version":"1.0","techniques":["T1027.004"]}],"sigma_rules":[{"id":"7b10f171-7f04-47c7-9fa2-5be43c76e535","title":"Visual Basic Command Line Compiler Usage","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","status":"test","level":"high","date":"2020-10-07","modified":"2021-11-27","description":"Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.","references":["https://lolbas-project.github.io/lolbas/Binaries/Vbc/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml","techniques":["T1027.004"],"cves":[]},{"id":"81ebd28b-9607-4478-bf06-974ed9d53ed7","title":"Potential Application Whitelisting Bypass via Dnx.EXE","author":"Beyu Denis, oscd.community","status":"test","level":"medium","date":"2019-10-26","modified":"2024-04-24","description":"Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.\nAttackers might abuse this in order to bypass application whitelisting.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/","https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml","techniques":["T1218","T1027.004"],"cves":[]},{"id":"acf2807c-805b-4042-aab9-f86b6ba9cb2b","title":"Dynamic .NET Compilation Via Csc.EXE - Hunting","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-02","modified":null,"description":"Detects execution of \"csc.exe\" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.","references":["https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/","https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf","https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/","https://twitter.com/gN3mes1s/status/1206874118282448897"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.004","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_csc_compilation.yml","techniques":["T1027.004"],"cves":[]},{"id":"b730a276-6b63-41b8-bcf8-55930c8fc6ee","title":"Csc.EXE Execution Form Potentially Suspicious Parent","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2019-02-11","modified":"2026-03-23","description":"Detects a potentially suspicious parent of \"csc.exe\", which could be a sign of payload delivery.","references":["https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing","https://reaqta.com/2017/11/short-journey-darkvnc/","https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.007","attack.t1218.005","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml","techniques":["T1059.005","T1059.007","T1218.005","T1027.004"],"cves":[]},{"id":"dcaa3f04-70c3-427a-80b4-b870d73c94c4","title":"Dynamic .NET Compilation Via Csc.EXE","author":"Florian Roth (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2019-08-24","modified":"2026-03-23","description":"Detects execution of \"csc.exe\" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.","references":["https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/","https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf","https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/","https://twitter.com/gN3mes1s/status/1206874118282448897","https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml","techniques":["T1027.004"],"cves":[]},{"id":"e4a74e34-ecde-4aab-b2fb-9112dd01aed0","title":"Dynamic CSharp Compile Artefact","author":"frack113","status":"test","level":"low","date":"2022-01-09","modified":"2023-02-17","description":"When C# is compiled dynamically, a .cmdline file will be created as a part of the process.\nCertain processes are not typically observed compiling C# code, but can do so without touching disk.\nThis can be used to unpack a payload for execution\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1027.004"],"path":"rules/windows/file/file_event/file_event_win_csharp_compile_artefact.yml","techniques":["T1027.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}