Detect JamPlus in Microsoft Sentinel
Adversaries may abuse the JamPlus build utility to proxy the execution of malicious scripts or binaries. JamPlus is a cross-platform build system that uses Jamfiles to describe build processes and dependencies. By embedding arbitrary shell commands within a specially crafted .jam file's Actions blocks, adversaries can execute payloads through a trusted developer tool. Because jam.exe carries a legitimate code-signing reputation, this technique is specifically used to bypass Smart App Control (SAC) and similar reputation-based application control mechanisms that would otherwise block unsigned or unknown executables.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.003 JamPlus
- Canonical reference
- https://attack.mitre.org/techniques/T1127/003/
KQL Detection Query
let SuspiciousChildProcesses = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
"msiexec.exe", "wmic.exe", "net.exe", "netsh.exe", "sc.exe",
"schtasks.exe", "curl.exe", "wget.exe", "ftp.exe", "whoami.exe",
"net1.exe", "nltest.exe", "dsquery.exe"
]);
let SuspiciousParents = dynamic([
"winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "onenote.exe",
"wscript.exe", "cscript.exe", "mshta.exe", "explorer.exe",
"powershell.exe", "pwsh.exe", "cmd.exe"
]);
let SuspiciousPaths = dynamic([
"\\temp\\", "\\tmp\\", "\\appdata\\local\\temp\\",
"\\downloads\\", "\\desktop\\", "\\public\\", "\\users\\public\\"
]);
// Branch 1: JamPlus spawning suspicious child processes (RiskScore 90)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "jam.exe" or InitiatingProcessFileName =~ "jamplus.exe"
| where FileName in~ (SuspiciousChildProcesses)
| extend RiskScore = 90
| extend DetectionBranch = "SuspiciousChildProcess"
| union (
// Branch 2: JamPlus spawned by non-development parent processes (RiskScore 85)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "jam.exe" or FileName =~ "jamplus.exe"
| where InitiatingProcessFileName in~ (SuspiciousParents)
| extend RiskScore = 85
| extend DetectionBranch = "SuspiciousParentProcess"
)
| union (
// Branch 3: JamPlus binary executing from user-writable or temp paths (RiskScore 75)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "jam.exe" or FileName =~ "jamplus.exe"
| where FolderPath has_any (SuspiciousPaths)
| extend RiskScore = 75
| extend DetectionBranch = "SuspiciousExecutionPath"
)
| union (
// Branch 4: JamPlus loading a Jamfile from a suspicious path via -f flag (RiskScore 70)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "jam.exe" or FileName =~ "jamplus.exe"
| where ProcessCommandLine has "-f"
| where ProcessCommandLine has_any (SuspiciousPaths)
| extend RiskScore = 70
| extend DetectionBranch = "SuspiciousJamfilePath"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine,
RiskScore, DetectionBranch
| sort by Timestamp descDetects abuse of the JamPlus build utility (jam.exe/jamplus.exe) using four detection branches targeting the key indicators documented in Cyble and Elastic Security Labs research. Branch 1 identifies JamPlus spawning LOLBins or scripting interpreters — direct evidence of malicious Jamfile execution. Branch 2 detects JamPlus launched by Office applications, script interpreters, or shell processes — indicating weaponized document or dropper delivery. Branch 3 catches JamPlus executing from user-writable paths (%TEMP%, Downloads, Desktop) atypical of legitimate build workflows. Branch 4 identifies JamPlus loading Jamfiles from suspicious directories via the explicit -f flag.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software development workflows where JamPlus is used as a primary build system and legitimately invokes cmd.exe or scripting engines as part of build steps — baseline known developer workstations and build servers
- Automated CI/CD pipelines (Jenkins, TeamCity, Azure DevOps self-hosted agents) running JamPlus builds that may execute from agent working directories or invoke shell utilities
- Developer IDEs or terminal emulators (such as Visual Studio Code or Windows Terminal, which appear as explorer.exe children) that invoke jam.exe for build tasks — explorer.exe parent is common for GUI-launched terminals
Other platforms for T1127.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1JamPlus Executes cmd.exe via Malicious Jamfile in TEMP
Expected signal: Sysmon Event ID 1: Process Create for jam.exe with CommandLine containing '-f' and a path under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage matching jam.exe path. Sysmon Event ID 11: File Create for %TEMP%\jamtest-output.txt written by cmd.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2JamPlus Executes PowerShell Download Cradle via Jamfile
Expected signal: Sysmon Event ID 1: Process Create for jam.exe from %TEMP%. Sysmon Event ID 1: Child Process Create for powershell.exe with ParentImage=jam.exe and CommandLine containing 'Net.WebClient' and 'DownloadString'. Sysmon Event ID 3: Network connection attempt from powershell.exe to 127.0.0.1:8080 (fails — no listener but event fires). PowerShell ScriptBlock Log Event ID 4104 with the download cradle content.
- Test 3JamPlus Binary Staged in TEMP Directory (Suspicious Execution Path)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\jam.exe (binary staging). Sysmon Event ID 1: Process Create for jam.exe with Image and FolderPath under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=%TEMP%\jam.exe and CommandLine containing 'net user'.
- Test 4JamPlus Spawned by Scripting Engine (Simulated VBScript Dropper Delivery)
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing dropper.vbs. Sysmon Event ID 1: Process Create for jam.exe with ParentImage=wscript.exe — this is the primary detection event. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=jam.exe, completing the three-level process chain wscript.exe → jam.exe → cmd.exe.
References (8)
- https://attack.mitre.org/techniques/T1127/003/
- https://cyble.com/blog/reputation-hijacking-with-jamplus-a-maneuver-to-bypass-smart-app-control-sac/
- https://www.elastic.co/security-labs/dismantling-smart-app-control
- https://jamplus.github.io/jamplus/quick_start.html
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/smart-app-control/
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1127.003 including response playbook, investigation guide, and atomic red team tests.