Compile After Delivery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018) Source code payloads may also be encrypted, encoded, and/or embedded ...
BY SOURCE
PROCEDURES (6)
Auto-extracted: 4 detections for process creation monitoring
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for suspicious