T1027.004: Compile After Delivery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe[1], csc.exe, or GCC/MinGW.[2]
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.[3]
Security context for executives and security teams
Compile After Delivery matters because it shifts suspicious content from an obvious executable into source code or another benign-looking form until it is compiled on the victim system. For leaders, the practical issue is whether security controls can see the transformation from text/source material into an executable across Windows, Linux, and macOS, rather than only scanning files at delivery time.
Executive priority
Prioritize this where endpoints or servers commonly have compilers, developer tooling, scripting frameworks, or permissive execution controls. The business risk is stealth: payloads may bypass controls focused on binaries and only become detectable at compile time. Leaders should ask whether SOC coverage includes compiler execution, source-to-binary creation, and unusual use of native utilities such as csc.exe, ilasm.exe, GCC, or MinGW, especially on systems where compilation is not expected.
Technical view
This is an enterprise ATT&CK stealth sub-technique of T1027 Obfuscated Files or Information for Linux, macOS, and Windows. MITRE describes adversaries delivering uncompiled code that must be compiled before execution, including use of native utilities such as ilasm.exe, csc.exe, GCC, or MinGW. The relationship context includes DET0501, a detection strategy focused on source-code-to-executable transformation, and ATT&CK maps multiple groups and software families to this behavior. SOC and IR teams should validate whether they can correlate source-like file delivery, compiler process execution, command-line context, parent-child process relationships, and creation of new executable artifacts.
Likely telemetry
- Process creation events for compiler utilities such as csc.exe, ilasm.exe, GCC, and MinGW where present
- Command-line arguments and working directories for compiler executions
- Parent-child process relationships showing what launched the compiler
- File creation and modification events for source-code-like files and newly created executables
- Endpoint security or EDR telemetry from Windows, Linux, and macOS systems
Detection direction
- Baseline legitimate compiler use by role and asset type; developer workstations and build servers will differ from ordinary user endpoints and servers.
- Alert on compiler execution from unusual parents, user profiles, temporary directories, downloaded locations, or document/script-driven chains where local policy says compilation is not expected.
- Correlate creation of text/source files with subsequent compiler execution and creation of executable binaries rather than relying on static detection of delivered files.
- Tune carefully for false positives in engineering, DevOps, security testing, and software build environments.
- Use the DET0501 relationship as direction to validate source-code-to-executable transformation coverage, while recognizing that the supplied ATT&CK object does not include detailed detection logic.
Mitigation priorities
- Inventory where compilers and build toolchains are legitimately required across Windows, Linux, and macOS.
- Restrict or remove compiler utilities from systems that do not need them, where operationally feasible.
- Apply application control or execution policy to limit unauthorized compiler and newly built binary execution.
- Ensure email, web, and endpoint controls inspect or log source-code-like attachments, embedded code, encoded content, and post-delivery execution chains where supported.
- Maintain SOC playbooks for investigating unexpected compilation, including source file origin, compiler parent process, generated binary path, and subsequent execution.
Additional notes and limits
This behavior is material because it can defeat programs that focus mainly on delivered executables. The strongest defensive question is not simply whether malware scanning is enabled, but whether the organization can observe and govern the moment source code becomes an executable. ATT&CK relationships show this technique is associated with several groups and software entries, including Gamaredon Group, MuddyWater, Rocke, Sea Turtle, Cardinal RAT, njRAT, Sliver, FoggyWeb, DarkWatchman, and Samurai; those mappings should guide threat-informed validation without implying current activity in any environment.
The official ATT&CK object provides no detection text and no mitigation text. The detection strategy relationship is named but not detailed in the supplied fields. Any final assessment of exposure or coverage requires local evidence about compiler presence, endpoint telemetry, logging quality, user roles, software development workflows, and execution-control policy.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Compile After Delivery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe[1], csc.exe, or GCC/MinGW.[2]
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.[3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1027 | Obfuscated Files or Information | This object subtechnique of Obfuscated Files or Information. |
| Enterprise | T1500 | Compile After Delivery | Compile After Delivery revoked by this object. |
Groups, software, and campaigns
G0047: Gamaredon Group
Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]
In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]
G0106: Rocke
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]
G0069: MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]
G1041: Sea Turtle
Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.[1][2][3][4]
S0633: Sliver
S0661: FoggyWeb
S0385: njRAT
S0348: Cardinal RAT
Cardinal RAT is a potentially low volume remote access trojan (RAT) observed since December 2015. Cardinal RAT is notable for its unique utilization of uncompiled C# source code and the Microsoft Windows built-in csc.exe compiler.[1]
S1099: Samurai
S0673: DarkWatchman
DarkWatchman is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 4cd804ad42e3… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]ATTACK IQ
Federico Quattrin, Nick Desler, Tin Tam, & Matthew Rutkoske. (2023, March 16). Hiding in Plain Sight: Monitoring and Testing for Living-Off-the-Land Binaries. Retrieved July 15, 2024.
Open source URL - [2]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [3]TrendMicro WindowsAppMac
Trend Micro. (2019, February 11). Windows App Runs on Mac, Downloads Info Stealer and Adware. Retrieved April 25, 2019.
Open source URL - [4]ESET Gamaredon June 2020
Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
Open source URL - [5]Cybereason Sliver Undated
Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.
Open source URL - [6]MSTIC FoggyWeb September 2021
Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
Open source URL - [7]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [8]Trend Micro njRAT 2018
Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
Open source URL - [9]PaloAlto CardinalRat Apr 2017
Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
Open source URL - [10]Kaspersky ToddyCat June 2022
Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
Open source URL - [11]Hunt Sea Turtle 2024
Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.
Open source URL - [12]Prevailion DarkWatchman 2021
Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
Open source URL - [13]ATTACK IQ
Federico Quattrin, Nick Desler, Tin Tam, & Matthew Rutkoske. (2023, March 16). Hiding in Plain Sight: Monitoring and Testing for Living-Off-the-Land Binaries. Retrieved July 15, 2024.
Open source URL - [14]ATTACK IQ
Federico Quattrin, Nick Desler, Tin Tam, & Matthew Rutkoske. (2023, March 16). Hiding in Plain Sight: Monitoring and Testing for Living-Off-the-Land Binaries. Retrieved July 15, 2024.
Open source URL - [15]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [16]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [17]TrendMicro WindowsAppMac
Trend Micro. (2019, February 11). Windows App Runs on Mac, Downloads Info Stealer and Adware. Retrieved April 25, 2019.
Open source URL - [18]TrendMicro WindowsAppMac
Trend Micro. (2019, February 11). Windows App Runs on Mac, Downloads Info Stealer and Adware. Retrieved April 25, 2019.
Open source URL - [19]mitre-attackT1027.004Open source URL
- [20]mitre-attackT1027.004Open source URL
- [21]mitre-attackT1027.004Open source URL
- [22]ESET Gamaredon June 2020
Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
Open source URL - [23]Cybereason Sliver Undated
Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.
Open source URL - [24]MSTIC FoggyWeb September 2021
Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
Open source URL - [25]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [26]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [27]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [28]Trend Micro njRAT 2018
Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
Open source URL - [29]PaloAlto CardinalRat Apr 2017
Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
Open source URL - [30]Kaspersky ToddyCat June 2022
Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
Open source URL - [31]Hunt Sea Turtle 2024
Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.
Open source URL - [32]Prevailion DarkWatchman 2021
Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.