Security tools inspect executables closely. Plain text source code gets far less attention. Some adversaries use that gap: they deliver code as text and let the victim's own compiler build the program.
MITRE tracks this as Compile After Delivery, technique T1027.004, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
The payload arrives as uncompiled source, which avoids protections aimed at executables and binaries. It is then compiled, usually with native utilities. MITRE names ilasm.exe, csc.exe and GCC or MinGW.
The source can also be encrypted, encoded or embedded in other files, for example one delivered by phishing. Payloads may arrive in a format that means nothing to the operating system, such as an EXE on macOS or Linux, and be rebuilt into a proper executable later using a bundled compiler and execution framework.
How to detect it
MITRE's strategy (DET0501) focuses on compilation that happens where it should not.
- Windows. csc.exe, ilasm.exe or msbuild.exe started by user-space processes outside typical development environments, followed by execution or network activity from the new binary.
- Linux. GCC or Clang run on suspicious paths such as /tmp or ~/Downloads, with executable output, followed by execution or outbound traffic.
- macOS. Non-standard compilation through Xcode command line tools or bundled GCC or Mono packages, writing new executables and running them outside developer folders.
The question to ask: does this host belong to a developer or a build system? A compiler running on an accountant's laptop at 3 a.m. is the signal. On a build server it is just Tuesday.
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. Sensible steps follow from the detection logic:
- Remove compilers and build tools from machines that do not need them.
- Use application control to restrict who and what may run compilers.
- Keep build work on dedicated, monitored build systems.
This is also a reminder that your own pipelines contain compilers by design. If you build software, review which packages and scripts are pulled into the build. You can scan a project manifest for risky packages with the free in-browser dependency scan. It needs no login, the file never leaves your machine, and it covers up to 100 dependencies.
Quick check
Why is compile after delivery harder for tools to catch?
The delivered file is text source code, not an executable, so protections aimed at binaries do not inspect it. The executable appears only after a local compiler builds it.
Sources
- MITRE ATT&CK, Compile After Delivery (T1027.004)
