T1027.004 - Compile After Delivery#
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac)
Atomic Tests#
Atomic Test #1 - Compile After Delivery using csc.exe#
Compile C# code using csc.exe binary used by .NET Upon execution an exe named T1027.004.exe will be placed in the temp folder
Supported Platforms: windows
Dependencies: Run with powershell!#
Description: C# file must exist on disk at specified location (#{input_file})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\T1027.004\src\calc.cs") {exit 0} else {exit 1}
Get Prereq Commands:#
New-Item -Type Directory (split-path "PathToAtomicsFolder\T1027.004\src\calc.cs") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/calc.cs" -OutFile "PathToAtomicsFolder\T1027.004\src\calc.cs"
Invoke-AtomicTest T1027.004 -TestNumbers 1 -GetPreReqs
Attack Commands: Run with command_prompt#
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:C:\Windows\Temp\T1027.004.exe "PathToAtomicsFolder\T1027.004\src\calc.cs"
Invoke-AtomicTest T1027.004 -TestNumbers 1
Cleanup:#
del C:\Windows\Temp\T1027.004.exe >nul 2>&1
Invoke-AtomicTest T1027.004 -TestNumbers 1 -Cleanup
Atomic Test #2 - Dynamic C# Compile#
When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution. The exe file that will be executed is named as T1027.004_DynamicCompile.exe is contained in the ‘bin’ folder of this atomic, and the source code to the file is in the ‘src’ folder. Upon execution, the exe will print ‘T1027.004 Dynamic Compile’.
Supported Platforms: windows
Dependencies: Run with powershell!#
Description: exe file must exist on disk at specified location (#{input_file})#
Check Prereq Commands:#
if (Test-Path "PathToAtomicsFolder\T1027.004\bin\T1027.004_DynamicCompile.exe") {exit 0} else {exit 1}
Get Prereq Commands:#
Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/bin/T1027.004_DynamicCompile.exe -OutFile "PathToAtomicsFolder\T1027.004\bin\T1027.004_DynamicCompile.exe"
Invoke-AtomicTest T1027.004 -TestNumbers 2 -GetPreReqs
Attack Commands: Run with powershell#
Invoke-Expression "PathToAtomicsFolder\T1027.004\bin\T1027.004_DynamicCompile.exe"
Invoke-AtomicTest T1027.004 -TestNumbers 2
Atomic Test #3 - C compile#
Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.
Supported Platforms: linux, macos
Dependencies: Run with sh!#
Description: the source file must exist on disk at specified location (#{input_file})#
Check Prereq Commands:#
if [ -e PathToAtomicsFolder/T1027.004/src/T1027-004-test.c ]; then exit 0; else exit 1; fi
Get Prereq Commands:#
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.c -O "PathToAtomicsFolder/T1027.004/src/T1027-004-test.c"
Invoke-AtomicTest T1027.004 -TestNumbers 3 -GetPreReqs
Attack Commands: Run with sh#
gcc PathToAtomicsFolder/T1027.004/src/T1027-004-test.c && ./a.out
clang PathToAtomicsFolder/T1027.004/src/T1027-004-test.c && ./a.out
Invoke-AtomicTest T1027.004 -TestNumbers 3
Atomic Test #4 - CC compile#
Compile a c file with either gcc or clang on FreeBSD, Linux or Macos.
Supported Platforms: linux, macos
Dependencies: Run with sh!#
Description: the source file must exist on disk at specified location (#{input_file})#
Check Prereq Commands:#
if [ -e PathToAtomicsFolder/T1027.004/src/T1027-004-test.cc ]; then exit 0; else exit 1; fi
Get Prereq Commands:#
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.cc -O PathToAtomicsFolder/T1027.004/src/T1027-004-test.cc
Invoke-AtomicTest T1027.004 -TestNumbers 4 -GetPreReqs
Attack Commands: Run with sh#
g++ PathToAtomicsFolder/T1027.004/src/T1027-004-test.cc && ./a.out
clang++ PathToAtomicsFolder/T1027.004/src/T1027-004-test.cc && ./a.out
Invoke-AtomicTest T1027.004 -TestNumbers 4
Atomic Test #5 - Go compile#
Compile a go file with golang on FreeBSD, Linux or Macos.
Supported Platforms: linux, macos
Dependencies: Run with sh!#
Description: the source file must exist on disk at specified location (#{input_file})#
Check Prereq Commands:#
if [ -e PathToAtomicsFolder/T1027.004/src/T1027-004-test.go ]; then exit 0; else exit 1; fi
Get Prereq Commands:#
wget https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.004/src/T1027-004-test.go -O PathToAtomicsFolder/T1027.004/src/T1027-004-test.go
Invoke-AtomicTest T1027.004 -TestNumbers 5 -GetPreReqs
Attack Commands: Run with sh#
go run PathToAtomicsFolder/T1027.004/src/T1027-004-test.go
Invoke-AtomicTest T1027.004 -TestNumbers 5
Detection#
Monitor the execution file paths and command-line arguments for common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. The compilation of payloads may also generate file creation and/or file write events. Look for non-native binary formats and cross-platform compiler and execution frameworks like Mono and determine if they have a legitimate purpose on the system.(Citation: TrendMicro WindowsAppMac) Typically these should only be used in specific and limited cases, like for software development.