Detect JamPlus in Sumo Logic CSE
Adversaries may abuse the JamPlus build utility to proxy the execution of malicious scripts or binaries. JamPlus is a cross-platform build system that uses Jamfiles to describe build processes and dependencies. By embedding arbitrary shell commands within a specially crafted .jam file's Actions blocks, adversaries can execute payloads through a trusted developer tool. Because jam.exe carries a legitimate code-signing reputation, this technique is specifically used to bypass Smart App Control (SAC) and similar reputation-based application control mechanisms that would otherwise block unsigned or unknown executables.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1127.003 JamPlus
- Canonical reference
- https://attack.mitre.org/techniques/T1127/003/
Sumo Detection Query
_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security"
| where EventID = "1" OR EventID = "4688"
/* Normalize field names across sourcetypes */
| if (EventID = "1", Image, NewProcessName) as process_image
| if (EventID = "1", ParentImage, ParentProcessName) as parent_image
| if (EventID = "1", CommandLine, CommandLine) as command_line
| if (EventID = "1", CurrentDirectory, "") as current_directory
| toLowerCase(process_image) as process_image_lower
| toLowerCase(parent_image) as parent_image_lower
| toLowerCase(command_line) as command_line_lower
| toLowerCase(current_directory) as current_dir_lower
/* Identify JamPlus involvement */
| where process_image_lower matches /.*\\(jam|jamplus)\.exe$/ OR parent_image_lower matches /.*\\(jam|jamplus)\.exe$/
/* Branch evaluation */
| if (parent_image_lower matches /.*\\(jam|jamplus)\.exe$/ AND process_image_lower matches /.*\\(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msiexec|wmic|schtasks|net|netsh|whoami|curl)\.exe$/, 1, 0) as suspicious_child
| if (process_image_lower matches /.*\\(jam|jamplus)\.exe$/ AND parent_image_lower matches /.*\\(winword|excel|powerpnt|outlook|onenote|wscript|cscript|mshta|explorer|powershell|pwsh|cmd)\.exe$/, 1, 0) as suspicious_parent
| if (process_image_lower matches /.*\\(jam|jamplus)\.exe$/ AND (current_dir_lower matches /.*\\(temp|tmp|downloads|desktop|public)\\.*/ OR current_dir_lower matches /.*\\appdata\\local\\temp\\.*/), 1, 0) as suspicious_path
| if (process_image_lower matches /.*\\(jam|jamplus)\.exe$/ AND command_line_lower matches /.*-f .*/ AND (command_line_lower matches /.*\\(temp|tmp|downloads|desktop|appdata)\\.*/ ), 1, 0) as suspicious_jamfile
/* Only keep events matching at least one branch */
| where suspicious_child = 1 OR suspicious_parent = 1 OR suspicious_path = 1 OR suspicious_jamfile = 1
/* Assign risk score (first match wins) */
| if (suspicious_child = 1, 90, if (suspicious_parent = 1, 85, if (suspicious_path = 1, 75, if (suspicious_jamfile = 1, 70, 60)))) as risk_score
| if (suspicious_child = 1, "SuspiciousChildProcess", if (suspicious_parent = 1, "SuspiciousParentProcess", if (suspicious_path = 1, "SuspiciousExecutionPath", if (suspicious_jamfile = 1, "SuspiciousJamfilePath", "Unknown")))) as detection_branch
| fields _messageTime, Computer, User, process_image, command_line, parent_image, current_directory, suspicious_child, suspicious_parent, suspicious_path, suspicious_jamfile, risk_score, detection_branch
| sort by _messageTime descDetects abuse of JamPlus build utility for signed binary proxy execution and Smart App Control bypass via Sumo Logic, normalizing across Sysmon (EventID 1) and Windows Security (EventID 4688) sources. Four risk-scored detection branches identify JamPlus spawning LOLBins, launched by Office/script parents, executing from temp/user-writable paths, or loading Jamfiles from suspicious locations.
Data Sources
Required Tables
False Positives & Tuning
- DevOps engineers running JamPlus from PowerShell terminals for cross-platform build testing
- Security researchers testing JamPlus behavior in sandboxed environments with temp-based working directories
- Game studio build automation invoking JamPlus from explorers or Office macros during asset pipeline generation
Other platforms for T1127.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1JamPlus Executes cmd.exe via Malicious Jamfile in TEMP
Expected signal: Sysmon Event ID 1: Process Create for jam.exe with CommandLine containing '-f' and a path under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage matching jam.exe path. Sysmon Event ID 11: File Create for %TEMP%\jamtest-output.txt written by cmd.exe. Security Event ID 4688 if command line auditing is enabled.
- Test 2JamPlus Executes PowerShell Download Cradle via Jamfile
Expected signal: Sysmon Event ID 1: Process Create for jam.exe from %TEMP%. Sysmon Event ID 1: Child Process Create for powershell.exe with ParentImage=jam.exe and CommandLine containing 'Net.WebClient' and 'DownloadString'. Sysmon Event ID 3: Network connection attempt from powershell.exe to 127.0.0.1:8080 (fails — no listener but event fires). PowerShell ScriptBlock Log Event ID 4104 with the download cradle content.
- Test 3JamPlus Binary Staged in TEMP Directory (Suspicious Execution Path)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\jam.exe (binary staging). Sysmon Event ID 1: Process Create for jam.exe with Image and FolderPath under %TEMP%. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=%TEMP%\jam.exe and CommandLine containing 'net user'.
- Test 4JamPlus Spawned by Scripting Engine (Simulated VBScript Dropper Delivery)
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing dropper.vbs. Sysmon Event ID 1: Process Create for jam.exe with ParentImage=wscript.exe — this is the primary detection event. Sysmon Event ID 1: Child Process Create for cmd.exe with ParentImage=jam.exe, completing the three-level process chain wscript.exe → jam.exe → cmd.exe.
References (8)
- https://attack.mitre.org/techniques/T1127/003/
- https://cyble.com/blog/reputation-hijacking-with-jamplus-a-maneuver-to-bypass-smart-app-control-sac/
- https://www.elastic.co/security-labs/dismantling-smart-app-control
- https://jamplus.github.io/jamplus/quick_start.html
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/smart-app-control/
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1127.003 including response playbook, investigation guide, and atomic red team tests.