kevmap

Techniques › T1127 › T1127.003

T1127.003 JamPlus

stealth · execution — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1127.003
0
KEV CVEs mapped here
<p>Adversaries may use JamPlus to proxy the execution of a malicious script. JamPlus is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.</p><p>Adversaries may abuse the JamPlus build utility to execute malicious scripts via a .jam file, which describes the build process and required dependencies. Because the malicious script is executed from a reputable developer tool, it may subvert application control security systems such as Smart App Control.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1127.003

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1127) 20

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Detection of PowerShell Execution via Sqlps.exe mediumtest
Author: Agro (@agro_sev) oscd.community · 2020-10-10 (modified 2022-12-09) · logsource: product=windows category=process_creation · 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Techniques: T1059.001T1127
Use of VSIISExeLauncher.exe mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-09 · logsource: product=windows category=process_creation · 18749301-f1c5-4efc-a4c3-276ff1f5b6f8
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Techniques: T1127
Potential Mftrace.EXE Abuse mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-09 (modified 2023-08-03) · logsource: product=windows category=process_creation · 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Techniques: T1127
Microsoft Workflow Compiler Execution mediumtest
Author: Nik Seetharaman, frack113 · 2019-01-16 (modified 2023-02-03) · logsource: product=windows category=process_creation · 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Techniques: T1127T1218
Use of Wfc.exe mediumtest
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-01 · logsource: product=windows category=process_creation · 49be8799-7b4d-4fda-ad23-cafbefdebbc5
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Techniques: T1127
Use of Remote.exe mediumtest
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-02 · logsource: product=windows category=process_creation · 4eddc365-79b4-43ff-a9d7-99422dc34b93
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Techniques: T1127
JScript Compiler Execution lowtest
Author: frack113 · 2022-05-02 (modified 2024-04-24) · logsource: product=windows category=process_creation · 52788a70-f1da-40dd-8fbd-73b5865d6568
Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Techniques: T1127
Potential Arbitrary Code Execution Via Node.EXE hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 6640f31c-01ad-49b5-beb5-83498a5cd8bd
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Techniques: T1127
C# IL Code Compilation Via Ilasm.EXE mediumtest
Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2022-05-07 (modified 2022-05-16) · logsource: product=windows category=process_creation · 850d55f9-6eeb-4492-ad69-a72338f65ba4
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Techniques: T1127
Suspicious Child Process of AspNetCompiler hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-14 · logsource: product=windows category=process_creation · 9ccba514-7cb6-4c5c-b377-700758f2f120
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Techniques: T1127
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-14 (modified 2025-02-24) · logsource: product=windows category=process_creation · 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Techniques: T1127
AspNetCompiler Execution mediumtest
Author: frack113 · 2021-11-24 (modified 2025-02-24) · logsource: product=windows category=process_creation · a01b8329-5953-4f73-ae2d-aa01e1f35f00
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
Techniques: T1127
SQL Client Tools PowerShell Session Detection mediumtest
Author: Agro (@agro_sev) oscd.communitly · 2020-10-13 (modified 2022-02-25) · logsource: product=windows category=process_creation · a746c9b8-a2fb-4ee5-a428-92bee9e99060
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Techniques: T1059.001T1127
Suspicious Use of CSharp Interactive Console hightest
Author: Michael R. (@nahamike01) · 2020-03-08 (modified 2022-07-14) · logsource: product=windows category=process_creation · a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
Detects the execution of CSharp interactive console by PowerShell
Techniques: T1127
Use of TTDInject.exe mediumtest
Author: frack113 · 2022-05-16 · logsource: product=windows category=process_creation · b27077d6-23e6-45d2-81a0-e2b356eea5fd
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Techniques: T1127
Potential Binary Proxy Execution Via Cdb.EXE mediumtest
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Techniques: T1106T1218T1127
Remote Thread Creation Ttdinject.exe Proxy hightest
Author: frack113 · 2022-05-16 (modified 2022-06-02) · logsource: product=windows category=create_remote_thread · c15e99a3-c474-48ab-b9a7-84549a7a9d16
Detects a remote thread creation of Ttdinject.exe used as proxy
Techniques: T1127
Kavremover Dropped Binary LOLBIN Usage hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-11-01 · logsource: product=windows category=process_creation · d047726b-c71c-4048-a99b-2e2f50dc107d
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Techniques: T1127
Node Process Executions mediumtest
Author: Max Altgelt (Nextron Systems) · 2022-04-06 · logsource: product=windows category=process_creation · df1f26d3-bea7-4700-9ea2-ad3e990cf90e
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Techniques: T1127T1059.007
Suspicious File Created by ArcSOC.exe highexperimental
Author: Micah Babinski · 2025-11-25 · logsource: product=windows category=file_event · e890acee-d488-420e-8f20-d9b19b3c3d43
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual.
Techniques: T1127T1105T1133