Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1027.004_compile-after-delivery
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.
Passed 20 of 21 test cases with the skill, and 13 of 21 without it.
and 7 more in the full report
7 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the name of the executable file contained in the bin folder for the dynamic C# compile atomic test?
| Checked | Without skill | With skill |
|---|---|---|
| Names the executable artifact T1027.004_DynamicCompile.exe. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1027
Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe, csc.exe, or GCC/MinGW.
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing. Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Compile C# code using csc.exe binary used by .NET Upon execution an exe named T1027.004.exe will be placed in the temp folder
Supported Platforms: windows
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:#{output_file} "#{input_file}"
test cases passed, vs 13 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.