T1127.003 — JamPlus
Tactics: Stealth, Execution · Platforms: Windows
Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio. Adversaries may abuse the…
Sub-technique of Trusted Developer Utilities Proxy Execution (T1127).
Sigma detection rules (1)
T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus
title: "T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus"
id: e75068d5-07e2-44f4-8a07-7e12ef6dfb03
description: 'Detects execution of JamPlus (jam.exe/jamplus.exe) invoking a .jam build script, which JamPlus uses to describe its build process and which adversaries may abuse to proxy execution of malicious scripts from a trusted developer utility. Tune using: TimeWindow, AllowedBuildHosts, SuspiciousChildList, RarePathRegex.'
references:
- https://attack.mitre.org/techniques/T1127/003
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
- attack.stealth
- attack.execution
- attack.t1127.003
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
Image|endswith:
- '\jam.exe'
- '\jamplus.exe'
selection_jamfile:
CommandLine|contains: '.jam'
condition: selection and selection_jamfile
falsepositives:
- Legitimate build activity on developer workstations using JamPlus for compiled projects - this rule is only meaningful on non-developer endpoints; scope tightly.
level: medium
Related sub-techniques
Explore