Lion Cipher Lab
Fingerprint TLS clients with JA3/JA4 to hunt malware C2
- SOC Analyst / Blue Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Most of the traffic leaving a network in 2026 is TLS-encrypted, which is usually framed as a defender's problem: you cannot read the payload, so how do you catch command-and-control that hides inside HTTPS? The quietly powerful answer is that you do not need the payload. The very first message of every TLS handshake — the ClientHello — is sent in cleartext, and it spells out exactly how the client's TLS library is configured: which TLS versions it offers, which cipher suites and in what order, which extensions and elliptic curves. Different software builds that message differently, so hashing…
What you'll learn
- understanding what a TLS ClientHello reveals in cleartext even when the session is encrypted
- defining JA3, JA4, JA3S/JA4S and the JA4+ suite, and how each fingerprint is built
- enabling ja3-fingerprints and ja4-fingerprints in suricata.yaml's app-layer.protocols.tls
- adding ja3/ja3s/ja4 to the eve-log tls output so the fingerprints land in eve.json
- generating distinct client stacks (curl, openssl s_client, python requests, a browser) to see different hashes
- reading .tls.ja3.hash, .tls.ja3.string, .tls.ja4 and .tls.sni out of eve.json with jq
- reading the JA4 a_b_c format and knowing why JA4 sorts ciphers where JA3 preserved order
- matching a JA3 against abuse.ch SSLBL and writing a ja3.hash Suricata rule
- judgment: a fingerprint identifies the CLIENT STACK, not the destination — the encrypted-C2 use case
- judgment: why JA3 is fragile (GREASE, library churn, deliberate mimicry) and superseded by JA4+
Steps in this lab
- The encrypted-traffic problem, and the thing the ClientHello gives away
- JA3 and its successor JA4 — what each one is
- Turn fingerprinting ON in suricata.yaml, then test and reload
- Generate distinct client stacks on purpose
- Read the fingerprints out of eve.json with jq
- Match a fingerprint against a public malicious-JA3 feed
- The judgment: a fingerprint names the software, never the intent
- What you built, and where it plugs in