JamPlus is a build utility for code and data build systems. It works with several popular compilers and can generate workspaces in editors such as Visual Studio. MITRE tracks its misuse as T1127.003, under Trusted Developer Utilities Proxy Execution. The tactics are stealth and execution, and the platform is Windows.
How attackers use it
A .jam file describes the build process and its dependencies. MITRE notes that adversaries can abuse JamPlus to run malicious scripts through such a file.
The reason it works is trust. The script runs from a reputable developer tool, so it may get past application control products such as Smart App Control. A defender who allows developer tools broadly can end up allowing this too.
How to detect it
MITRE's detection strategy is a behavior chain: JamPlus.exe launching payloads from crafted .jam files, with abnormal process creation, command execution or artifact generation outside standard development workflows.
Practical signals:
JamPlus.exerunning on a machine that is not a developer workstation or build server.- Child processes of JamPlus that a normal build would not start, such as script interpreters or network tools.
.jamfiles appearing in user download or temp folders.
Process creation logs with parent and command line (Security event 4688 or Sysmon event ID 1) are the main data source.
How to reduce the risk
- Remove it if unused. JamPlus may not be necessary in your environment.
- Block or restrict it. If you cannot remove it, use execution prevention rules so only the machines and users that need it can run it.
Quick check
Why can a build tool bypass application control?
It is a reputable developer tool, so the scripts it runs may be treated as trusted by controls such as Smart App Control.
Sources
- MITRE ATT&CK, T1127.003 JamPlus
