JamPlus Build Tool Proxy Execution - Suspicious jam.exe Activity

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•2

Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.