THREAT HUNTING WITH JA4/JA4S (+ PRACTICAL KQL QUERIES)

Summary from the TLDR InfoSec newsletter

JA4 is a TLS fingerprint that shows how a client connects, not just where it connects to. Unlike JA3, part of it is readable, so hunters can see the TLS version, SNI, cipher count, and ALPN at a glance. The post includes KQL queries to pull these values from Entra ID sign-ins and Defender network logs, so teams can learn what normal looks like and spot clients that don't match.