Project

General

Profile

Actions

Feature #2754

closed

JA3 and JA3S - sets / reputation

Added by Victor Julien almost 3 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Support matching on large amounts of ja3/ja3s hashes.


Related issues

Related to Task #2685: SuriCon 2018 brainstormNewVictor JulienActions
Related to Feature #2684: Add JA3SClosedMats KlepslandActions
Blocked by Feature #2318: matching on large amounts of data with dynamic updatesClosedVictor JulienActions
Actions #1

Updated by Victor Julien almost 3 years ago

  • Related to Task #2685: SuriCon 2018 brainstorm added
Actions #2

Updated by Victor Julien almost 3 years ago

  • Blocked by Feature #2318: matching on large amounts of data with dynamic updates added
Actions #3

Updated by Victor Julien almost 3 years ago

Actions #4

Updated by Victor Julien almost 3 years ago

  • Tracker changed from Bug to Feature
Actions #5

Updated by Victor Julien about 2 years ago

  • Target version changed from TBD to 5.0rc1

TLS JA3/JA3S:

Blacklist:

alert tls any any -> any any (ja3.hash; dataset:isset,bad_ja3_hash, load bad_ja3_hash.rep, type string; sid:3;)

Reputation:

alert tls any any -> any any (ja3s.hash; datarep:ja3s_rep, >, 200, load ja3s_rep.rep, type string; sid:4;)
alert tls any any -> any any (ja3s.string; datarep:ja3s_str_rep, >, 200, load ja3s_str_rep.rep, type md5; sid:5;)

https://github.com/OISF/suricata/pull/4166

https://suricata.readthedocs.io/en/latest/rules/datasets.html

Actions #6

Updated by Victor Julien about 2 years ago

  • Status changed from Assigned to Closed
Actions

Also available in: Atom PDF