MITRE ATT&CKsub-technique

T1127.003 JamPlus

Published 2025-03-21 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Execution
Platforms
Windows
Version
2.0
Created
2025-03-21

Description

Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio. Adversaries may abuse the `JamPlus` build utility to execute malicious scripts via a `.jam` file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1127 Trusted Developer Utilities Proxy Execution technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation

References