Techniques › T1127.003 › AN1610
AN1610 Analytic 1610
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Abuse of JamPlus.exe to launch malicious payloads via crafted .jam files, resulting in abnormal process creation, command execution, or artifact generation outside of standard development workflows.</p>
- Detects
- T1127.003 JamPlus
- Part of
- DET0585 Behavior-chain detection strategy for T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Microsoft-Windows-CodeIntegrity/Operational | Unsigned or untrusted modules loaded during JamPlus.exe runtime | DC0034 Process Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation time window (e.g., 0–30 minutes) for JamPlus.exe execution, child processes, and file/network events. |
AllowedBuildHosts | Known developer systems where JamPlus.exe usage is expected; alerts are raised if executed elsewhere. |
SuspiciousChildList | Child processes considered anomalous (e.g., PowerShell, cmd, wscript) when spawned by JamPlus.exe. |
RarePathRegex | Regex patterns for non-standard or user-writable paths where JamPlus.exe drops artifacts. |