Implementing and Analysis of JA3 data for TLS Fingerprinting using Bro/Zeek Data

No ratings

Presented at BSidesOttawa 2019 by

Ahmed Techini

I was implementing JA3 (open source from salesforce) for a complex environment to show the value of TLS fingerprinting for network security detection. My approach is hybrid since I was mixing data from network (using open source Bro) and data collected from host (A commercial EDR) to map every JA3 to a process name. My end game is to create a whitelist of JA3 (mainly baseline the use of TLS in our environment) that could be help security monitoring to detect new TTPs as Domain fronting. I already presented some of my research internally and It is the first time to present it outside.