Question

A threat hunter suspects a custom malware sample is using a bespoke TLS library, which would produce a client-side JA3 fingerprint that no legitimate application in the fleet generates. They want a YARA-L 2.0 hunt rule that surfaces network connections whose JA3 hash has never been observed in the environment before the current 24-hour hunt window, while excluding hashes that appear across many hosts (indicating common software). Which approach best fits this hypothesis?

Accepted Answer

Use an outcome section to compute distinct host count per JA3 hash across the match window and a reference list of previously-seen JA3 hashes, filtering to hashes absent from the list and with a low distinct-host count.

Answer

Write a single-event rule that fires whenever network.tls.client.ja3 is not empty, relying on the analyst to manually sort the results by frequency afterward.

Answer

Match only on GTI-provided malicious JA3 IOCs joined against network events, since first-seen hunting requires a confirmed indicator to anchor the query.

Answer

Aggregate on destination IP prevalence rather than JA3 hash, because TLS fingerprints are too volatile to baseline reliably across a fleet.