How Does JA4/JA4H Analyze Client Architecture for WAF Detection?

Client Architecture in JA4/JA4H WAF Detection plays a crucial role in understanding the true nature of the device connecting to your web applications. JA4 and JA4H leverage TLS fingerprinting to map and monitor client characteristics, helping Web Application Firewalls (WAFs) distinguish between legitimate and suspicious traffic. This blog explores how these signatures decode client architecture and help detect malicious activity.

🔍 What Are JA4 and JA4H?

Together, they give a stack-aware view of a client, enabling analysts to spot inconsistencies between expected and actual behavior.

🔐 How JA4 Works (TLS Fingerprinting)

JA4 captures elements of the TLS ClientHello message during a handshake:

• Cipher suite list and order
• TLS extensions
• Elliptic curve preferences
• ALPN (Application-Layer Protocol Negotiation)
• TLS version

🧪 Example JA4 Fingerprint:

0a15_E.1F.1D.1A.0.1

This unique code reflects the TLS handshake behavior of the client. By comparing it to known patterns, you can determine:

• Browser (e.g., Chrome, Firefox)
• Operating system (e.g., Linux, Windows)
• TLS library (e.g., OpenSSL, BoringSSL, NSS)

🌐 How JA4H Works (HTTP Fingerprinting)

JA4H evaluates HTTP metadata and structure:

• HTTP method (GET, POST, etc.)
• Protocol version (HTTP/1.1, HTTP/2)
• Header count and order
• Cookie presence
• Hashes of headers

🧪 Example JA4H Fingerprint:

0a15_E.1F.1D.1A.0.1

It helps distinguish between:

🛠️ Combining JA4 + JA4H: Detecting Client Stack & Architecture

When combined, JA4 and JA4H offer deep insights into:

• Client architecture (x86_64 vs ARM)
• TLS/HTTP stack (Python bot, browser, curl, malware)
• Headless tools (Selenium, Puppeteer)
• Obfuscation or spoofing attempts

👇 Example Scenarios:

🔒 Security Use Cases for WAF & SOC

✅ Threat Hunting

• Detect imposter clients (wrong UA but different JA4/JA4H)
• Spot mass botnets with repeated JA4 patterns

✅ SOC Investigation

• Correlate logs using $ja4 and $ja4h in SIEM systems
• Identify suspicious JA4H patterns (e.g., short header lists)

✅ WAF Rules

• Block clients with obsolete JA4 (e.g., TLS 1.0 fingerprints)
• Monitor new JA4s that don’t match known clients

⚙️ Tools to Use

• JA4-NGINX Module: Injects JA4/JA4H into logs
  👉 GitHub
• Suricata JA4 Rules (in progress): For inline detection
• Wireshark & Zeek: Can extract TLS fingerprint traits
• Threat Intelligence Feeds: Map known malware JA4s

🧩 Fingerprint Inference Cheat Sheet

📌 Why It Matters

• Traditional user-agent headers are easy to spoof.
• IPs change, VPNs rotate — but JA4+JA4H is hard to fake.
• This fingerprinting is lightweight but highly effective for SOCs, WAFs, and DFIR teams.

🔚 Final Thoughts

Fingerprinting using JA4 and JA4H is a powerful weapon in the hands of defenders. It gives us visibility into the real client stack, enabling smarter, faster, and deeper detection.

As client stacks evolve, defenders must evolve too — and fingerprinting is how we stay ahead of the threats.