Introduction

Encryption has become the default for modern network communications. While this is a major win for privacy and security, it has also created a visibility gap for defenders. HTTPS, TLS 1.3, and Encrypted Client Hello limit the effectiveness of traditional deep packet inspection, leaving security teams blind to many forms of command and control and data exfiltration activity.

To address this challenge, QRadar has added native support for JA4 Client TLS fingerprinting, providing SOC teams with a powerful new signal for detecting threats hidden within encrypted traffic without requiring decryption.

JA4 fingerprinting enables QRadar Network Insights(QNI) to identify and correlate TLS clients based on how they initiate encrypted sessions, rather than what data they transmit. This shift restores meaningful network visibility at the earliest stage of every encrypted connection.

What Is JA4 Fingerprinting?

JA4 is a modern, standardised fingerprint that represents a client’s TLS behaviour during the Client Hello phase of a TLS handshake.

When a client initiates a secure connection, several metadata fields remain unencrypted and observable. JA4 extracts and normalises these fields to produce a stable behavioural fingerprint, including:

• TLS version negotiation
• Cipher suite selection and ordering
• TLS extension types and ordering
• Supported groups and key share behaviour
• Signature algorithms
• ALPN values

Each operating system, browser, application, or malware framework tends to produce a unique and repeatable TLS handshake pattern. JA4 converts these patterns into a compact, structured fingerprint that can be ingested, searched, and correlated inside QRadar.

How QNI Generates JA4 from Network Traffic?

When QRadar ingests network telemetry from supported sensors, flow sources, or integrations (such as NDR platforms and network analytics tools), it observes TLS Client Hello messages in real time.

From each Client Hello, QNI extracts relevant TLS attributes, normalizes them to reduce noise, and constructs a JA4 string. This string is then hashed to produce a JA4 client fingerprint that is stored as part of the network event or flow record.

A typical JA4 value appears as:

ja4=t13d1516h2_8daafc7b0d0f_9f1c3a2b4c

This value represents the client side TLS behaviour and remains consistent across IP address, domain, and certificate changes.

It can be seen in the Network Activity tab as below:

JA4 Hash:  t12d280700_d943125447b4_3c5a66c0

Breakdown of the JA4 Hash

In a threat hunting context, JA4 fingerprints like t12d280700_d943125447b4_3c5a66c0 serve as effective pivots.

This JA4 fingerprint clearly does not represent normal user browsing activity. It describes a minimal TLS 1.2 client with a limited cipher list, very few extensions, and no advertised elliptic curves behaviour that immediately deviates from modern browsers. 

This profile is characteristic of OpenSSL or curl based tooling, which is commonly reused by commodity malware and C2 frameworks due to its simplicity and consistency.

While this JA4 can appear in legitimate automation or backend services, its presence on user endpoints or in traffic to unknown infrastructure should be treated as suspicious by default.

Using JA4 Client Fingerprinting with QRadar Rules and Offenses

Here is the step by step guide to create a basic rule that fires an offense when the malwares are being detected.

From the Offenses tab, click Rules.

From the Action list, select New Flow Rule to create a new rule.

From the test group, you can use the property TLS JA4 Hash and match it with the regex you want. In this case, regex contains the known Trojans, Linux Miner, IcedID Malware, GoLang malware, etc. Destination port is 443. The group will be Malware.

The next step is to create a new event or create an offense based on the rule we created in the last step.

Final Rule Summary

Click on the finish, and a new Rule will be created and displayed in the rules list.

With the Rules and offenses using the TLS JA4 hashes, users can identify the threat elements in a better way.

Analysts can hunt for fingerprints that are newly observed, appear across multiple hosts, or deviate from known application baselines.

Even when attackers rotate infrastructure, JA4 fingerprints often remain unchanged, allowing QRadar to track malicious activity that would otherwise evade traditional indicators.

Through this blog, we demonstrated how IBM QRadar SIEM, with QRadar Network Insights (QNI) and its JA4 Client fingerprinting capability, enhances visibility into encrypted traffic and helps protect enterprise environments against a wide range of threats. Additional use cases can be developed and tailored based on specific organisational requirements and security objectives.

If you have any questions about the topics discussed or would like to explore these capabilities further, please feel free to reach out to us for a detailed discussion.

Author - Kajal Sangani (kajal.sangani@ibm.com)

Reviewer - Boudhayan Chakrabarty(Bob) (bochakra@ib.ibm.com)