Post #2872962
2026-05-07 13:27 UTC
@DaveMWilburn@infosec.exchange @adulau@infosec.exchange They end up being _an_ indicator, but even groups of them together rly shld be used with other attributes for any type of clustering IMO.
Then there's the fact these are pretty much only good as hunt IoCs, not block or detect IoCs b/c too much is under attacker control, and publishing any set of JA4s in public tips them off and the good ones can and do tweak them (the problem is not as terrible as JA3, but it's up there). 2/
Replies (1)
-
@hrbrmstr@mastodon.social 2026-05-07 13:29
@DaveMWilburn@infosec.exchange @adulau@infosec.exchange I've seen actors rotate through scads of JA4t and JA4h in a single campaign b/c so much is under their control. They are decent to use when dealing with C-lister attackers, but a giant problem that coming for us all is that real (i.e., not mirai-users) attackers are migrating to sitting behind residental proxies. And, even some mirai users are doing that too. Then the ciphers, 4t and 4h hashes are only good at telling you "yep! residential proxies!" 3/