1200KM / detection
T1027.004 Compile After Delivery — Detection Rules
Detection workspace for T1027.004 Compile After Delivery: 5 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Dynamic CSharp Compile Artefact · test · low · {"product":"windows","category":"file_event"}
- Dynamic .NET Compilation Via Csc.EXE · test · medium · {"category":"process_creation","product":"windows"}
- Csc.EXE Execution Form Potentially Suspicious Parent · test · high · {"category":"process_creation","product":"windows"}
- Potential Application Whitelisting Bypass via Dnx.EXE · test · medium · {"category":"process_creation","product":"windows"}
- Visual Basic Command Line Compiler Usage · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0501 Detection Strategy for Compile After Delivery - Source Code to Executable Transformation
AN1381 Analytic 1381
Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries.
AN1382 Analytic 1382
Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries.
AN1383 Analytic 1383
Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder).
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.