JA4+ Expands Network Fingerprinting for Threat Hunting
Summary
John Althouse discusses JA4+, a suite of network fingerprinting techniques designed to help identify threats across multiple protocols, and explains how fingerprinting supports threat hunting and detection.
Key points
- JA4+ extends network fingerprinting beyond TLS to a broader range of protocols.
- Althouse says the techniques can help identify threat actor infrastructure, malware, session hijacking, bot traffic, and malicious clients and access points.
- The interview describes JA3 as a passive TLS client fingerprinting standard and JARM as an active TLS server fingerprinting tool.
- Althouse says JA4+ has dedicated support and plans for a curated fingerprint database with API access.
- He recommends looking for fingerprints of command-and-control connections, unapproved applications, and unusual activity in both corporate network and cloud application logs.
- Althouse identifies social engineering leading to cloud account takeovers as a major threat, including cases involving stolen session tokens.
Article Details
- Topic
- Interview with John Althouse about JA4+ network fingerprinting, threat hunting, and FoxIO.
People
0xdfIdentified as the person who exploited a follow-up request in the Jarmis tool to gain root on the scanning system.Andrew SmartNamed as a co-developer of JARM.Jeff AtkinsonNamed as a co-developer of the JA3 TLS Client Fingerprinting standard.John AlthouseCybersecurity professional interviewed about developing JA4+ and threat hunting; founded FoxIO.Josh AtkinsNamed as a co-developer of the JA3 TLS Client Fingerprinting standard.Mike BradyNamed as a co-developer of JARM.MitnickNamed as an inspiration to Althouse's high school computer club.RJ NunnallyNamed as a co-developer of JARM.Sara JelenInterviewer whose perspective on the human element in cybersecurity is described in the article.
Vendors
Products
AWSand servers, vastly increasing detection fidelity. JA3/S has been built into products including Greynoise, AWS, Cloudflare, Azure, Google, and many more.Azureincreasing detection fidelity. JA3/S has been built into products including Greynoise, AWS, Cloudflare, Azure, Google, and many more.Censysand Mike Brady. JARM also has wide adoption in the industry, built into products such as Hunt, runZero, Censys, Palo Alto Networks, Google and many more.Cloudflarevastly increasing detection fidelity. JA3/S has been built into products including Greynoise, AWS, Cloudflare, Azure, Google, and many more.Googledetection fidelity. JA3/S has been built into products including Greynoise, AWS, Cloudflare, Azure, Google, and many more.Greynoiseclients and servers, vastly increasing detection fidelity. JA3/S has been built into products including Greynoise, AWS, Cloudflare, Azure, Google, and many more.Hack The BoxJohn: I never expected JARM to turn into a Hack The Box target. They had a tool called Jarmis that would scan a destination with JARM, report back the fingerprint and check it against a known-bad list. If known-bad, itHuntRJ Nunnally, and Mike Brady. JARM also has wide adoption in the industry, built into products such as Hunt, runZero, Censys, Palo Alto Networks, Google and many more.JA3with a focus on developing innovative network fingerprinting techniques, such as JA4+ , a successor to JA3, a TLS Client Fingerprinting standard, which has seen widespread adoption in the industry.JA3/Swithout the need to break TLS, this made it possible to detect TLS-based malware on the network. JA3/S was released a year later allowing for the fingerprinting of TLS connections between clients and servers,JA4+around threat hunting, with a focus on developing innovative network fingerprinting techniques, such as JA4+ , a successor to JA3, a TLS Client Fingerprinting standard, which has seen widespread adoption in theJARMIn 2020 JARM, an active TLS server fingerprinting tool, was released by myself, Andrew Smart, RJ Nunnally, and Mike Brady. JARM also has wide adoption in the industry, built into products such as Hunt, runZero, Censys,Palo Alto NetworksJARM also has wide adoption in the industry, built into products such as Hunt, runZero, Censys, Palo Alto Networks, Google and many more.runZeroNunnally, and Mike Brady. JARM also has wide adoption in the industry, built into products such as Hunt, runZero, Censys, Palo Alto Networks, Google and many more.SoftEther VPNJohn: Microsoft has been seeing a lot of APT activity using SoftEther VPN and Google has been seeing a lot of session hijacking happening lately. Given that these companies are considered to be the best of the best and