Open cardosec

Case 0EE672 · Blue team / DFIR · L3 Applied

Hunting with JA3 and JA4

Practise as: Explain it · Interview · Deep diveLevel: L3 Applied

Interview questionHow do TLS client fingerprints like JA3 and JA4 help a hunt, and where do they fall short?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview As Deep dive
What a strong answer covers

Try it out loud first. Then check yourself:

  1. JA3 hashes fields from the TLS ClientHello (version, ciphers, extensions, curves); the same client library tends to produce the same hash.
  2. Browsers randomizing extension order (Chrome since 2023) made JA3 unstable; JA4 sorts those fields and is readable, so it stays stable.
  3. Hunt for fingerprints that are rare in your estate, or a known browser fingerprint coming from a process that is not a browser.
  4. Fingerprints identify a TLS library, not malware: many tools share one, and attackers can mimic browsers on purpose.

If the interviewer pushes back

  • A JA4 fingerprint matching a common C2 framework shows up from 40 developer laptops. How do you decide whether this is a hunt finding?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09