KQL Search

Query Details

Hunting Entra ID Sign Ins With JA4

Query

//Sergio Albea 13-09-2026
EntraIdSignInEvents | where Timestamp > ago(1d) and isnotempty(GatewayJA4)
| extend JA4Parts = split(GatewayJA4, "_")
| extend JA4_A = tostring(JA4Parts[0]), JA4_CipherHash = tostring(JA4Parts[1]), JA4_ExtensionHash = tostring(JA4Parts[2])
| extend Transport = substring(JA4_A, 0, 1), TLSVersion = substring(JA4_A, 1, 2), SNI = substring(JA4_A, 3, 1), CipherCount = toint(substring(JA4_A, 4, 2)), ExtensionCount = toint(substring(JA4_A, 6, 2)),
    ALPN = substring(JA4_A, 8, 2)
| summarize SignIns = count(), Users = dcount(AccountUpn), IPs = dcount(IPAddress), Countries = dcount(Country)
    by GatewayJA4, Transport, TLSVersion, SNI, CipherCount, ExtensionCount, ALPN, JA4_CipherHash, JA4_ExtensionHash

About this query

MITRE ATT&CK Technique(s)

Technique IDTitle
T1078.004Valid Accounts: Cloud Accounts

Author: Sergio Albea (13/09/2026)

Hunting Entra ID Sign-ins with JA4

Description: The EntraIdSignInEvents table exposes the JA4 fingerprint in the GatewayJA4 field. But looking at the complete fingerprint alone does not tell us much. The interesting part starts when we break it down. With a simple KQL query, we can separate the TLS version, SNI, number of cipher suites, extensions and ALPN, together with the cipher and extension hashes. Then we can see how many sign-ins, users, IPs and countries are behind each JA4. The idea is simple: understand what is normal first, then look for what is different.

Explanation

This query is designed to analyze sign-in events from the Entra ID (formerly Azure AD) by examining the JA4 fingerprint, which is a way to identify and categorize TLS (Transport Layer Security) connections. Here's a simple breakdown of what the query does:

  1. Data Source: It looks at the EntraIdSignInEvents table to find sign-in events that have a non-empty GatewayJA4 field, which contains the JA4 fingerprint.

  2. Time Frame: It focuses on events from the last day (ago(1d)).

  3. JA4 Fingerprint Breakdown: The query splits the GatewayJA4 string into parts to extract specific details:

    • Transport: The type of transport protocol.
    • TLS Version: The version of TLS used.
    • SNI: Server Name Indication, part of the TLS handshake.
    • Cipher Count: Number of cipher suites used.
    • Extension Count: Number of TLS extensions used.
    • ALPN: Application-Layer Protocol Negotiation, used to negotiate the application protocol.

  4. Hash Values: It extracts hashes for ciphers and extensions from the JA4 fingerprint.

  5. Summarization: The query summarizes the data by counting:

    • Total sign-ins (SignIns).
    • Distinct users (Users).
    • Distinct IP addresses (IPs).
    • Distinct countries (Countries).

  6. Purpose: By understanding the normal patterns of these JA4 components, security analysts can identify anomalies or unusual sign-in activities that might indicate potential security threats.

In essence, the query helps in identifying normal and abnormal sign-in behaviors based on the detailed breakdown of the JA4 fingerprint, which can be crucial for detecting unauthorized access or other security issues.