MITRE ATT&CKsub-technique
T1127.003 JamPlus
- Domain
- enterprise
- Tactics
- Stealth, Execution
- Platforms
- Windows
- Version
- 2.0
- Created
- 2025-03-21
Description
Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.
Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1127 Trusted Developer Utilities Proxy Execution technique