Obfuscated Files or Information: Compile After Delivery
- ID
- T1027.004
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1027 Obfuscated Files or Information
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Creation, File Creation, Network Connection Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe[1], csc.exe, or GCC/MinGW.[2]
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.[3]
Detection
- DET0501 Detection Strategy for Compile After Delivery - Source Code to Executable Transformation
Data components: Process Creation, File Creation, Network Connection Creation