Trusted Developer Utilities Proxy Execution: JamPlus
- ID
- T1127.003
- Tactics
- TA0002 Execution, TA0005 Stealth
- Sub-technique of
- T1127 Trusted Developer Utilities Proxy Execution
- Platforms
- Windows
- Data sources
- Process Creation, File Creation, Network Connection Creation, Process Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use JamPlus to proxy the execution of a malicious script. JamPlus is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.[1]
Adversaries may abuse the JamPlus build utility to execute malicious scripts via a .jam file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.[2][3]
Detection
- DET0585 Behavior-chain detection strategy for T1127.003 Trusted Developer Utilities Proxy Execution: JamPlus (Windows)
Data components: Process Creation, File Creation, Network Connection Creation, Process Metadata
Mitigations (2)
- M1038 Execution Prevention
Consider blocking or restricting JamPlus if not required.
- M1042 Disable or Remove Feature or Program
JamPlus may not be necessary within a given environment and should be removed if not used.