Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1127.003sub-technique of T1127 Trusted Developer Utilities Proxy Execution

JamPlus

Windowsnothing on this site yetT1127.003 on attack.mitre.org

Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio. Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Behavior-chain detection strategy for T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus (Windows)

  • Abuse of JamPlus.exe to launch malicious payloads via crafted.jam files, resulting in abnormal process creation, command execution, or artifact generation outside of standard development workflows.

what reduces it

  • M1038 Execution Prevention. Consider blocking or restricting JamPlus if not required.
  • M1042 Disable or Remove Feature or Program. JamPlus may not be necessary within a given environment and should be removed if not used.

the rest of T1127

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.