T1027.004 Obfuscated Files or Information: Compile After Delivery

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. MITRE ATT&CK

2 programs on CmdID 5 Sigma rules T1027.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1027Obfuscated Files or Information

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows

highVisual Basic Command Line Compiler UsageEnsar Şamil, @sblmsrsn, @oscd_initiative · Windows

mediumDynamic .NET Compilation Via Csc.EXEFlorian Roth (Nextron Systems), X__Junior (Nextron Systems) · Windows

mediumDynamic .NET Compilation Via Csc.EXE - HuntingNasreddine Bencherchali (Nextron Systems) · Windows