T1027.004 — Compile After Delivery

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution;…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.004 Obfuscated Files or Information: Compile After Delivery

title: "T1027.004 Obfuscated Files or Information: Compile After Delivery"
id: d8beb7ab-d727-41af-9308-c5df07921e9b
description: 'Detects compilation of delivered source via csc.exe/ilasm.exe/vbc.exe/GCC. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessName, OutputDirectoryPath, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/004
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.stealth
  - attack.t1027.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_compiler_exec:
    Image|endswith:
      - '\csc.exe'
      - '\ilasm.exe'
      - '\vbc.exe'
      - '\gcc.exe'
      - '\g++.exe'
      - '\jsc.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_build_tooling:
    ParentImage|endswith:
      - '\MSBuild.exe'
      - '\devenv.exe'
      - '\dotnet.exe'
  condition: selection_compiler_exec and not filter_system_account and not filter_build_tooling

falsepositives:
  - Developer/CI build activity.

level: medium

T1027.004 Obfuscated Files or Information: Compile After Delivery

title: "T1027.004 Obfuscated Files or Information: Compile After Delivery"
id: 706991ea-f9c3-4a1e-adb0-d72b3a7a16c4
description: 'Detects compiler invocations (gcc/cc/clang/g++) whose argv contains an output path in a temporary/world-writable directory, the auditd-observable proxy for T1027.004 compile-after-delivery. The prior version checked only argv position a1 for the output path, but common invocations (e.g. "gcc -o /tmp/x file.c") place -o at a1 and the path itself at a2, so this fix checks a1, a2, and a3 independently rather than assuming a fixed position. Tune using: CompilerBinaryPath, FilePermissionProfile.'
references:
  - https://attack.mitre.org/techniques/T1027/004
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.stealth
  - attack.t1027.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_compile:
    type: EXECVE
    a0|endswith:
      - '/gcc'
      - '/cc'
      - '/clang'
      - '/g++'
  selection_outpath_a1:
    a1|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_outpath_a2:
    a2|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_outpath_a3:
    a3|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'

  condition: selection_compile and (selection_outpath_a1 or selection_outpath_a2 or selection_outpath_a3)

falsepositives:
  - Legitimate development or build activity occurring in temporary directories, e.g., CI/CD runners or package build scripts.

level: high

T1027.004 Obfuscated Files or Information: Compile After Delivery

title: "T1027.004 Obfuscated Files or Information: Compile After Delivery"
id: c5b3020a-2be2-44a6-b862-6816a172b9e3
description: 'Detection Strategy for Compile After Delivery - Source Code to Executable Transformation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CompilerInvocationPattern, OutputBinaryPath.'
references:
  - https://attack.mitre.org/techniques/T1027/004
author: Shahrukh Khan
date: 2026-02-13
license: MIT
tags:
  - attack.stealth
  - attack.t1027.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/clang'
      - '/gcc'
      - '/swiftc'
  selection_output:
    CommandLine|contains: '-o '
  selection_path:
    CommandLine|contains:
      - '/tmp/'
      - '/private/tmp/'
  condition: selection and selection_output and selection_path

falsepositives:
  - Legitimate developer builds that compile source into a temporary output directory as part of a CI pipeline.

level: medium

Related sub-techniques

Explore