ATT&CK technique
View on MITRE ATT&CK →
T1027.004
Compile After Delivery
Stealth
11 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | GenAI Process Compiling or Generating Executables | production | 2026-09-25 |
| elastic | Suspicious .NET Code Compilation | production | 2026-09-18 |
| elastic | Microsoft Build Engine Started an Unusual Process | production | 2026-09-18 |
| splunk | Linux Suspicious GCC Invocation Building Init Shared Object | production | 2026-07-08 |
| splunk | CSC Net On The Fly Compilation | production | 2026-05-13 |
| sigma | Dynamic .NET Compilation Via Csc.EXE | test | 2026-03-23 |
| sigma | Csc.EXE Execution Form Potentially Suspicious Parent | test | 2026-03-23 |
| sigma | Potential Application Whitelisting Bypass via Dnx.EXE | test | 2024-04-24 |
| sigma | Dynamic .NET Compilation Via Csc.EXE - Hunting | test | 2023-08-02 |
| sigma | Dynamic CSharp Compile Artefact | test | 2023-02-17 |
| sigma | Visual Basic Command Line Compiler Usage | test | 2021-11-27 |