Technology and tools
What is JA3?
A fingerprint of how a client starts a TLS connection, which can identify specific malware or tools even when the traffic is encrypted.
JA3 is a method of fingerprinting the TLS ClientHello message, the first message a client sends when starting an encrypted connection. Fields such as the TLS version, cipher suites and extensions are combined into a hash. JA3S does the same for the server's reply, and the newer JA4 suite extends the idea.
Because many malware families and tools build their TLS connections in a fixed way, the fingerprint can flag them without decrypting the traffic. Fingerprints can be changed or shared with common software, so they work best combined with other signals.