Detect JamPlus in Splunk
Adversaries may abuse the JamPlus build utility to proxy the execution of malicious scripts or binaries. JamPlus is a cross-platform build system that uses Jamfiles to describe build processes and dependencies. By embedding arbitrary shell commands within a specially crafted .jam file's Actions blocks, adversaries can execute payloads through a trusted developer tool. Because jam.exe carries a legitimate code-signing reputation, this technique is specifically used to bypass Smart App Control (SAC) and similar reputation-based application control mechanisms that would otherwise block unsigned or unknown executables.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.003 JamPlus
- Canonical reference
- https://attack.mitre.org/techniques/T1127/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval IsJamExe=if(match(Image, "(?i)(\\\\jam\.exe|\\\\jamplus\.exe)$"), 1, 0)
| eval IsJamParent=if(match(ParentImage, "(?i)(\\\\jam\.exe|\\\\jamplus\.exe)$"), 1, 0)
| where IsJamExe=1 OR IsJamParent=1
| eval SuspiciousChild=if(
IsJamParent=1 AND match(Image, "(?i)(\\\\cmd\.exe|\\\\powershell\.exe|\\\\pwsh\.exe|\\\\wscript\.exe|\\\\cscript\.exe|\\\\mshta\.exe|\\\\rundll32\.exe|\\\\regsvr32\.exe|\\\\certutil\.exe|\\\\bitsadmin\.exe|\\\\msiexec\.exe|\\\\wmic\.exe|\\\\schtasks\.exe|\\\\net\.exe|\\\\netsh\.exe|\\\\whoami\.exe|\\\\curl\.exe)$"),
1, 0)
| eval SuspiciousParent=if(
IsJamExe=1 AND match(ParentImage, "(?i)(\\\\winword\.exe|\\\\excel\.exe|\\\\powerpnt\.exe|\\\\outlook\.exe|\\\\onenote\.exe|\\\\wscript\.exe|\\\\cscript\.exe|\\\\mshta\.exe|\\\\explorer\.exe|\\\\powershell\.exe|\\\\pwsh\.exe)$"),
1, 0)
| eval SuspiciousPath=if(
IsJamExe=1 AND match(lower(CurrentDirectory), "(\\\\temp\\\\|\\\\tmp\\\\|\\\\downloads\\\\|\\\\desktop\\\\|\\\\public\\\\|\\\\appdata\\\\local\\\\temp\\\\)"),
1, 0)
| eval SuspiciousJamfile=if(
IsJamExe=1 AND match(CommandLine, "(?i)-f\s") AND match(lower(CommandLine), "(\\\\temp\\\\|\\\\tmp\\\\|\\\\downloads\\\\|\\\\desktop\\\\|\\\\public\\\\|\\\\appdata\\\\)"),
1, 0)
| where SuspiciousChild=1 OR SuspiciousParent=1 OR SuspiciousPath=1 OR SuspiciousJamfile=1
| eval RiskScore=case(
SuspiciousChild=1, 90,
SuspiciousParent=1, 85,
SuspiciousPath=1, 75,
SuspiciousJamfile=1, 70,
true(), 60)
| eval DetectionBranch=case(
SuspiciousChild=1, "SuspiciousChildProcess",
SuspiciousParent=1, "SuspiciousParentProcess",
SuspiciousPath=1, "SuspiciousExecutionPath",
SuspiciousJamfile=1, "SuspiciousJamfilePath",
true(), "Unknown")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, CurrentDirectory, SuspiciousChild, SuspiciousParent, SuspiciousPath, SuspiciousJamfile, RiskScore, DetectionBranch
| sort - _timeDetects JamPlus (jam.exe/jamplus.exe) abuse using Sysmon Event ID 1. Evaluates four suspicious patterns mapped to the same branches as the KQL detection: jam.exe spawning LOLBins as child processes (RiskScore 90), jam.exe launched by Office or scripting engine parents (RiskScore 85), jam.exe executing from user-writable temp/download directories via CurrentDirectory (RiskScore 75), and jam.exe loading Jamfiles from suspicious paths via -f flag in CommandLine (RiskScore 70). The RiskScore field enables analyst triage prioritization and threshold-based alerting.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate software development workflows where JamPlus is used as a primary build system and legitimately invokes cmd.exe or scripting engines as part of build steps — baseline known developer workstations and build servers
- Automated CI/CD pipelines (Jenkins, TeamCity, Azure DevOps self-hosted agents) running JamPlus builds that may execute from agent working directories or invoke shell utilities
- Developer IDEs or terminal emulators (such as Visual Studio Code or Windows Terminal, which appear as explorer.exe children) that invoke jam.exe for build tasks — explorer.exe parent is common for GUI-launched terminals
Other platforms for T1127.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1JamPlus Executes cmd.exe via Malicious Jamfile in TEMP
Expected signal: Sysmon Event ID 1: Process Create for jam.exe with CommandLine containing '-f' and a path under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage matching jam.exe path. Sysmon Event ID 11: File Create for %TEMP%\jamtest-output.txt written by cmd.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2JamPlus Executes PowerShell Download Cradle via Jamfile
Expected signal: Sysmon Event ID 1: Process Create for jam.exe from %TEMP%. Sysmon Event ID 1: Child Process Create for powershell.exe with ParentImage=jam.exe and CommandLine containing 'Net.WebClient' and 'DownloadString'. Sysmon Event ID 3: Network connection attempt from powershell.exe to 127.0.0.1:8080 (fails — no listener but event fires). PowerShell ScriptBlock Log Event ID 4104 with the download cradle content.
- Test 3JamPlus Binary Staged in TEMP Directory (Suspicious Execution Path)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\jam.exe (binary staging). Sysmon Event ID 1: Process Create for jam.exe with Image and FolderPath under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=%TEMP%\jam.exe and CommandLine containing 'net user'.
- Test 4JamPlus Spawned by Scripting Engine (Simulated VBScript Dropper Delivery)
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing dropper.vbs. Sysmon Event ID 1: Process Create for jam.exe with ParentImage=wscript.exe — this is the primary detection event. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=jam.exe, completing the three-level process chain wscript.exe → jam.exe → cmd.exe.
References (8)
- https://attack.mitre.org/techniques/T1127/003/
- https://cyble.com/blog/reputation-hijacking-with-jamplus-a-maneuver-to-bypass-smart-app-control-sac/
- https://www.elastic.co/security-labs/dismantling-smart-app-control
- https://jamplus.github.io/jamplus/quick_start.html
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/smart-app-control/
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1127.003 including response playbook, investigation guide, and atomic red team tests.