T1500.md

T1500 - Compile After Delivery

Description from ATT&CK

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Spearphishing Attachment. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)

Atomic Tests

• Atomic Test #1 - Compile After Delivery using csc.exe

Atomic Test #1 - Compile After Delivery using csc.exe

Compile C# code using csc.exe binary used by .NET

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
input_file	C# code that launches calc.exe from a hidden cmd.exe Window	file	$PathToAtomicsFolder\T1500\src\calc.cs
output_file	Output compiled binary	file	C:\Windows\Temp\T1500.exe

Attack Commands: Run with command_prompt!

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} #{input_file}

Cleanup Commands:

del #{output_file}