Detect JamPlus in CrowdStrike LogScale
Adversaries may abuse the JamPlus build utility to proxy the execution of malicious scripts or binaries. JamPlus is a cross-platform build system that uses Jamfiles to describe build processes and dependencies. By embedding arbitrary shell commands within a specially crafted .jam file's Actions blocks, adversaries can execute payloads through a trusted developer tool. Because jam.exe carries a legitimate code-signing reputation, this technique is specifically used to bypass Smart App Control (SAC) and similar reputation-based application control mechanisms that would otherwise block unsigned or unknown executables.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.003 JamPlus
- Canonical reference
- https://attack.mitre.org/techniques/T1127/003/
LogScale Detection Query
// T1127.003 - JamPlus Signed Binary Proxy Execution Detection
// Covers 4 detection branches with risk scoring
#event_simpleName = ProcessRollup2
| FileName =~ regex("(?i)^(jam|jamplus)\.exe$") OR ParentBaseFileName =~ regex("(?i)^(jam|jamplus)\.exe$")
// Branch 1: JamPlus spawning suspicious LOLBin child processes (RiskScore 90)
| SuspiciousChild := if(
ParentBaseFileName =~ regex("(?i)^(jam|jamplus)\.exe$") AND
FileName =~ regex("(?i)^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msiexec|wmic|schtasks|net|netsh|whoami|curl|nltest|dsquery|net1)\.exe$"),
"true", "false")
// Branch 2: JamPlus spawned by suspicious parent process (RiskScore 85)
| SuspiciousParent := if(
FileName =~ regex("(?i)^(jam|jamplus)\.exe$") AND
ParentBaseFileName =~ regex("(?i)^(winword|excel|powerpnt|outlook|onenote|wscript|cscript|mshta|explorer|powershell|pwsh|cmd)\.exe$"),
"true", "false")
// Branch 3: JamPlus running from user-writable temp/staging paths (RiskScore 75)
| SuspiciousPath := if(
FileName =~ regex("(?i)^(jam|jamplus)\.exe$") AND
ImageFileName =~ regex("(?i)(\\\\temp\\\\|\\\\tmp\\\\|\\\\downloads\\\\|\\\\desktop\\\\|\\\\public\\\\|appdata\\\\local\\\\temp\\\\)"),
"true", "false")
// Branch 4: JamPlus loading Jamfile from suspicious path via -f flag (RiskScore 70)
| SuspiciousJamfile := if(
FileName =~ regex("(?i)^(jam|jamplus)\.exe$") AND
CommandLine =~ regex("(?i)-f\\s") AND
CommandLine =~ regex("(?i)(\\\\temp\\\\|\\\\tmp\\\\|\\\\downloads\\\\|\\\\desktop\\\\|\\\\appdata\\\\|\\\\public\\\\)"),
"true", "false")
// Only retain events matching at least one branch
| SuspiciousChild = "true" OR SuspiciousParent = "true" OR SuspiciousPath = "true" OR SuspiciousJamfile = "true"
// Assign risk score
| RiskScore := if(SuspiciousChild = "true", "90",
if(SuspiciousParent = "true", "85",
if(SuspiciousPath = "true", "75",
if(SuspiciousJamfile = "true", "70", "60"))))
// Assign detection branch label
| DetectionBranch := if(SuspiciousChild = "true", "SuspiciousChildProcess",
if(SuspiciousParent = "true", "SuspiciousParentProcess",
if(SuspiciousPath = "true", "SuspiciousExecutionPath",
if(SuspiciousJamfile = "true", "SuspiciousJamfilePath", "Unknown"))))
| table([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName,
ParentCommandLine, ImageFileName, SuspiciousChild, SuspiciousParent,
SuspiciousPath, SuspiciousJamfile, RiskScore, DetectionBranch])
| sort(timestamp, order=desc)CrowdStrike LogScale (Falcon telemetry) detection for JamPlus abuse (T1127.003) using ProcessRollup2 events. Four risk-scored branches detect: JamPlus spawning LOLBin child processes (risk 90), JamPlus launched by Office/scripting engine parents (risk 85), JamPlus executing from user-writable/temp paths (risk 75), and JamPlus loading Jamfiles from suspicious locations via -f flag (risk 70). Leverages native Falcon process telemetry including parent-child relationships and full command line capture.
Data Sources
Required Tables
False Positives & Tuning
- Embedded systems developers using JamPlus as the primary build tool on endpoints also running Office applications, triggering parent-child false positives when builds are launched from IDE macros
- QA automation frameworks that download and execute JamPlus from temporary directories as part of cross-platform test harness setup
- Game engine CI on developer machines where JamPlus assets pipeline is invoked from PowerShell scripts with working directories in APPDATA or user profile subfolders
Other platforms for T1127.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1JamPlus Executes cmd.exe via Malicious Jamfile in TEMP
Expected signal: Sysmon Event ID 1: Process Create for jam.exe with CommandLine containing '-f' and a path under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage matching jam.exe path. Sysmon Event ID 11: File Create for %TEMP%\jamtest-output.txt written by cmd.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2JamPlus Executes PowerShell Download Cradle via Jamfile
Expected signal: Sysmon Event ID 1: Process Create for jam.exe from %TEMP%. Sysmon Event ID 1: Child Process Create for powershell.exe with ParentImage=jam.exe and CommandLine containing 'Net.WebClient' and 'DownloadString'. Sysmon Event ID 3: Network connection attempt from powershell.exe to 127.0.0.1:8080 (fails — no listener but event fires). PowerShell ScriptBlock Log Event ID 4104 with the download cradle content.
- Test 3JamPlus Binary Staged in TEMP Directory (Suspicious Execution Path)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\jam.exe (binary staging). Sysmon Event ID 1: Process Create for jam.exe with Image and FolderPath under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=%TEMP%\jam.exe and CommandLine containing 'net user'.
- Test 4JamPlus Spawned by Scripting Engine (Simulated VBScript Dropper Delivery)
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing dropper.vbs. Sysmon Event ID 1: Process Create for jam.exe with ParentImage=wscript.exe — this is the primary detection event. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=jam.exe, completing the three-level process chain wscript.exe → jam.exe → cmd.exe.
References (8)
- https://attack.mitre.org/techniques/T1127/003/
- https://cyble.com/blog/reputation-hijacking-with-jamplus-a-maneuver-to-bypass-smart-app-control-sac/
- https://www.elastic.co/security-labs/dismantling-smart-app-control
- https://jamplus.github.io/jamplus/quick_start.html
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/smart-app-control/
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1127.003 including response playbook, investigation guide, and atomic red team tests.