ATT&CK - 传递后编译

admin 2024年4月15日01:58:01评论9 views字数 2246阅读7分29秒阅读模式




Compile After Delivery

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to Obfuscated Files or Information(1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.

Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Spearphishing Attachment(T1193). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.


名称 描述
Cardinal RAT(S0348) Cardinal RAT(S0348) 及其看门狗组件作为嵌入式未编译的源代码交付给受害者后,便会进行编译和执行。
MuddyWater(G0069) MuddyWater(G0069) 已使用.NET csc.exe工具从下载的C#代码编译可执行文件。
Name Description
Cardinal RAT(S0348) Cardinal RAT(S0348) and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.
MuddyWater(G0069) MuddyWater(G0069) has used the .NET csc.exe tool to compile executables from downloaded C# code.



This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.



Monitor the execution file paths and command-line arguments for common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. The compilation of payloads may also generate file creation and/or file write events. Look for non-native binary formats and cross-platform compiler and execution frameworks like Mono and determine if they have a legitimate purpose on the system. Typically these should only be used in specific and limited cases, like for software development.

- 译者: 林妙倩、戴亦仑 .

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
  • 本文由 发表于 2024年4月15日01:58:01
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   ATT&CK - 传递后编译


匿名网友 填写信息