JamPlus-spawned shell runs a script interpreter or downloader

Siemphony@siemphonymediumT1127.003unverified

AN1610 describes JamPlus being handed a crafted `.jam` file so that the build utility, rather than the adversary's own binary, is what executes the payload — the point being that a reputable developer tool passes application control where an unknown executable would not. An earlier version of this rule pinned `ParentImage` to `jam.exe` and listed the interpreter or downloader directly as the `Image`, which is one process generation too shallow: Jam (and JamPlus, which forks Perforce Jam) does not exec an action's command directly on Windows, it runs every action through the shell, building `cmd.exe /Q/C <action>` and, for multi-line or over-length actions, spilling to a generated temporary `.bat` file. A `.jam` action of `powershell -enc ...` therefore produces `powershell.exe` with `ParentImage` `\cmd.exe`, not `\jam.exe` — ten of the eleven entries in that child list could never fire, and what remained, `jam.exe` spawning `cmd.exe`, is this rule's own highest-volume false positive with no discriminating power left once the dead entries are stripped out. This version anchors on the real shape of the behaviour instead: `jam.exe` or `JamPlus.exe` (MITRE's own spelling, added here — the original binary name was omitted from the parent list entirely) as `ParentImage` of `cmd.exe`, and MITRE's `SuspiciousChildList` knob, populated here with script-host and living-off-the-land tokens, is checked against that shell's own `CommandLine` rather than a further child's image — which the `process_creation` category can carry because Sysmon EID 1 attaches the full command line to the shell's own process-creation event. This still misses a payload that arrives via the temp-`.bat` spill: for a multi-line or over-length action, only `cmd.exe /Q/C C:\...\jamXXXX.bat` is visible on this event, and the interpreter or downloader token that would trigger a match sits inside the batch file's content, which process creation does not carry. Two further limits. T1127.003 is bring-your-own-binary — the operator supplies the JamPlus copy, so the name is theirs to pick — and the parent list only reaches the two spellings above; a rename to any other name defeats it, which is why a second path is ORed in keying on `ParentCommandLine` containing `.jam`, so a renamed copy invoked against a jamfile still lands somewhere, at the cost of matching any command line that merely references a path with a `.jam` extension. And no process-creation event, on Sysmon or on Security 4688, carries the parent's original file name — the earlier description blamed this on 4688 specifically, which was wrong; there is no vocabulary in which a renamed parent falls back to a true name. The analytic's other legs — the artefact written to a user-writable path behind MITRE's `RarePathRegex` knob (Sysmon 11), and the egress that follows (Sysmon 3 and 22) — are separate events inside MITRE's `TimeWindow` knob, and lib/sigma has no timeframe or join to tie them to the execution here. MITRE's `AllowedBuildHosts` knob, scoping alerts to machines where JamPlus is not expected, is a deployment-time filter with no field on the event either. Vocabulary and prerequisite: the brief maps Security 4688 onto Sigma's `process_creation` category, which is Sysmon-shaped, and this rule is written in that vocabulary (`Image`, `ParentImage`, `CommandLine`, `ParentCommandLine`); a 4688 feed needs those mapped from `NewProcessName`/`ParentProcessName`/ `CommandLine` first, and produces nothing at all until Audit Process Creation is enabled, which no default install or baseline turns on. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0585, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((InitiatingProcessFolderPath endswith "\\jam.exe" or InitiatingProcessFolderPath endswith "\\JamPlus.exe") or InitiatingProcessCommandLine contains ".jam") and FolderPath endswith "\\cmd.exe") and (ProcessCommandLine contains "powershell" or ProcessCommandLine contains "pwsh" or ProcessCommandLine contains "wscript" or ProcessCommandLine contains "cscript" or ProcessCommandLine contains "mshta" or ProcessCommandLine contains "rundll32" or ProcessCommandLine contains "regsvr32" or ProcessCommandLine contains "certutil" or ProcessCommandLine contains "curl" or ProcessCommandLine contains "bitsadmin"))

Splunk · SPL

Run this as a search.

index=* ((((ParentImage="*\\jam.exe" OR ParentImage="*\\JamPlus.exe") OR ParentCommandLine="*.jam*") AND Image="*\\cmd.exe") AND (CommandLine="*powershell*" OR CommandLine="*pwsh*" OR CommandLine="*wscript*" OR CommandLine="*cscript*" OR CommandLine="*mshta*" OR CommandLine="*rundll32*" OR CommandLine="*regsvr32*" OR CommandLine="*certutil*" OR CommandLine="*curl*" OR CommandLine="*bitsadmin*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((TO_LOWER(process.parent.executable) LIKE "*\\\\jam.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\jamplus.exe") OR TO_LOWER(process.parent.command_line) LIKE "*.jam*") AND TO_LOWER(process.executable) LIKE "*\\\\cmd.exe") AND (TO_LOWER(process.command_line) LIKE "*powershell*" OR TO_LOWER(process.command_line) LIKE "*pwsh*" OR TO_LOWER(process.command_line) LIKE "*wscript*" OR TO_LOWER(process.command_line) LIKE "*cscript*" OR TO_LOWER(process.command_line) LIKE "*mshta*" OR TO_LOWER(process.command_line) LIKE "*rundll32*" OR TO_LOWER(process.command_line) LIKE "*regsvr32*" OR TO_LOWER(process.command_line) LIKE "*certutil*" OR TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*bitsadmin*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\jam\.exe$|\\JamPlus\.exe$)</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|curl|bitsadmin)</field>    <description>JamPlus-spawned shell runs a script interpreter or downloader (1/2)</description>    <mitre>      <id>T1127.003</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentCommandLine" type="pcre2">(?i)\.jam</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|curl|bitsadmin)</field>    <description>JamPlus-spawned shell runs a script interpreter or downloader (2/2)</description>    <mitre>      <id>T1127.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: b051e3ba-491a-4e97-a475-f44019fe298c

ATT&CKT1127.003

T1127.003JamPlus

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxy

01 · What this rule detects

Attacker code executed through a Microsoft-signed utility so that the execution inherits a trusted signature and a familiar image name — rundll32, regsvr32, mshta, cmstp, msiexec, regasm and their relatives. The binary is legitimate and present on every Windows host; the arguments are what belongs to the attacker. This is worth catching because signature checks, allowlists and any rule that filters on 'signed by Microsoft' will pass it.

02 · Telemetry you need

Process creation with the complete, untruncated command line and the parent — Sysmon EventID 1, or Security 4688 with both Audit Process Creation and the command-line inclusion policy enabled; neither is on by default
Sysmon EventID 7 (ImageLoad) Image and ImageLoaded, to see which module a proxy binary actually loaded
Sysmon EventID 3 (NetworkConnect) tied to the same process id — these binaries fetching remote content is the loudest variant
Sysmon EventID 11 (FileCreate) for the scriptlet, DLL or MSI written just before execution
AppLocker or WDAC audit events (Microsoft-Windows-AppLocker EXE/DLL, MSI and Script logs) — present only where a policy is deployed, even in audit mode

03 · How the logic works

The image name alone is not a detection: rundll32 and msiexec run constantly on a healthy host. Every workable rule in this class is an AND between the image and the shape of its argument. The argument is where the signal lives — a URL or UNC path passed to regsvr32 or msiexec, a scriptlet extension, a protocol handler in an mshta argument, an INF file outside the VPN profile directories for cmstp, a DLL path under a user-writable directory, or rundll32 invoked with no arguments at all. Parentage is the second anchor and often the better one: these binaries launched by an Office application, a browser or a script host mean something quite different from the same binary launched by the installer service. Resist writing one rule per binary with a long keyword list — a rule per binary, anchored on that binary's specific abuse shape, stays readable and tunes independently.

04 · Common false positives

Software distribution running installers — SCCM, Intune and their msiexec invocations, including repair and reinstall
Printer, display and device drivers, which use rundll32 with printui.dll and similar entry points routinely
Control Panel applets and legacy shell handlers invoked through rundll32 by Explorer
Line-of-business applications still shipping HTA front ends, and vendor setup wrappers that call regsvr32 during registration
Genuine VPN client provisioning through cmstp, and .NET installers calling InstallUtil or RegAsm during deployment

05 · Detection maturity

Tier 1 — starting point: Matches known abuse strings in the command line of a handful of these binaries.
Tier 2 — tuned: Pairs each binary with its specific abuse shape and the parent process, excluding software distribution by signed path.
Tier 3 — correlated: Adds the loaded module, the file written immediately before, and whether that module has been seen anywhere else in the fleet.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline the module and entry-point pairs your fleet actually uses for rundll32; the recurring ones are a short list and the outliers are the point of the rule
Alert first on the network-facing arguments — a remote path in the command line is the highest-payoff single condition in this category
Exclude on parent process and account together rather than on the argument, because the argument is the attacker's half
Match the argument case-insensitively and allow for quoting and extra whitespace; these command lines are assembled by hand
Where the telemetry has it, prefer the loaded-module event over the command line for rundll32 — it records what was really loaded rather than what was asked for

Declared by the author

Genuine JamPlus builds. A .jam file's action blocks are shell commands, so an ordinary build shells out through cmd.exe for compile, link, copy and packaging steps, and dependency fetching or code signing legitimately reaches for curl.exe, certutil.exe or PowerShell from inside that same cmd.exe command line. On any developer workstation or CI agent that actually uses JamPlus this is the highest-volume match by a wide margin, which is what sets the level here; MITRE's AllowedBuildHosts knob is where those machines are excluded.
Unrelated software shipping a binary called jam.exe or JamPlus.exe. Neither name is reserved, so any bundled updater, audio tool or line-of-business utility of that name satisfies the parent leg whenever it shells out through cmd.exe with one of the listed tokens on the line for its own purposes.
Any other build or automation tool that happens to take a path containing .jam as an argument — a changelog, a config file, a project folder named for a person called Jamie or James — and separately shells out through cmd.exe with one of the listed tokens on the line, since selection_parent_renamed is a substring match on the parent's full command line rather than an argument-position or file-extension check, and it is not tied to the token that made the rest of the condition true.
Build bootstrap and toolchain glue written in older styles, where a wrapper .jam target's action runs wscript.exe or cscript.exe through cmd.exe to execute a VBScript packaging or versioning helper as a normal part of the build.
Developers running a build by hand from an interactive session while debugging a build failure, which produces the same jam-to-cmd-to-tool chain in bursts and outside any scheduled build window.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1127.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/b051e3ba-491a-4e97-a475-f44019fe298c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

JamPlus-spawned shell runs a script interpreter or downloader

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it