Detecting Cobalt Strike beacons with JA3 and JARM fingerprinting

This article describes how defenders can use JA3 (client-side) and JARM (server-side) TLS fingerprinting as enrichment signals to detect Cobalt Strike beacons, covering telemetry collection (Zeek, Suricata, proxies), normalization, baselining, enrichment with DNS/endpoint/process context, confidence scoring, tuning to reduce false positives, and sensible triage/response guidance for small UK organisations.