Compile Payload Source Code Locally

[VenuK]

Dear Team,

We wanted to restrict compilers on our environment after a pentest resulted with Compile Payload Source Code Locally, we have common compilers like csc.exe and GCC/MinGW. 

We wanted to know how to identify any common suspicious behavior exe's along with the csc.exe and GCC/MinGW compilers, suggest me the best way to restrict the compilers.

[eumbach]

Hello @VenuK , 

We have used an active directory group to identify developers in our environment and then created a policy to allow for that AD group in XDR to run compilers. 

We also are using a codesigning certificate to 'whitelist' any developer applications which follow the signing process. 

[VenuK]

Thank you @eumbach for the quick suggestion