Detect JamPlus in Google Chronicle

rule jamplus_proxy_execution_t1127_003 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects JamPlus (jam.exe/jamplus.exe) abuse for signed binary proxy execution (T1127.003). Covers suspicious child processes, suspicious parent processes, execution from user-writable paths, and loading Jamfiles from suspicious locations via -f flag."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1127.003"
    reference = "https://attack.mitre.org/techniques/T1127/003/"
    version = "1.0"
    created = "2026-04-18"

  events:
    (
      /* Branch 1: JamPlus spawning suspicious child processes */
      (
        $e1.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e1.principal.process.file.full_path, `(?i)(\\jam\.exe|\\jamplus\.exe)$`)
        and re.regex($e1.target.process.file.full_path, `(?i)(\\cmd\.exe|\\powershell\.exe|\\pwsh\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\rundll32\.exe|\\regsvr32\.exe|\\certutil\.exe|\\bitsadmin\.exe|\\msiexec\.exe|\\wmic\.exe|\\schtasks\.exe|\\net\.exe|\\netsh\.exe|\\whoami\.exe|\\curl\.exe|\\nltest\.exe)$`)
      )
      or
      /* Branch 2: JamPlus launched by suspicious parent processes */
      (
        $e1.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e1.target.process.file.full_path, `(?i)(\\jam\.exe|\\jamplus\.exe)$`)
        and re.regex($e1.principal.process.file.full_path, `(?i)(\\winword\.exe|\\excel\.exe|\\powerpnt\.exe|\\outlook\.exe|\\onenote\.exe|\\wscript\.exe|\\cscript\.exe|\\mshta\.exe|\\explorer\.exe|\\powershell\.exe|\\pwsh\.exe|\\cmd\.exe)$`)
      )
      or
      /* Branch 3: JamPlus executing from user-writable/temp paths */
      (
        $e1.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e1.target.process.file.full_path, `(?i)(\\jam\.exe|\\jamplus\.exe)$`)
        and re.regex($e1.target.process.file.full_path, `(?i)(\\temp\\|\\tmp\\|\\downloads\\|\\desktop\\|\\public\\|appdata\\local\\temp\\)`)
      )
      or
      /* Branch 4: JamPlus loading Jamfile from suspicious path via -f flag */
      (
        $e1.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e1.target.process.file.full_path, `(?i)(\\jam\.exe|\\jamplus\.exe)$`)
        and re.regex($e1.target.process.command_line, `(?i)-f\s`)
        and re.regex($e1.target.process.command_line, `(?i)(\\temp\\|\\tmp\\|\\downloads\\|\\desktop\\|\\appdata\\|\\public\\)`)
      )
    )

  condition:
    $e1