How do you use JARM to hunt C2 infrastructure?

JARM is an active TLS-server fingerprint: you send crafted ClientHellos and hash the server's responses. Default C2 team servers (Cobalt Strike, Sliver, Metasploit) produce recognisable JARM values, so you query Shodan or Censys for those values, then triage candidates with TLS-certificate pivots (e.g. Cobalt Strike's default serial 146473198), default ports and passive DNS before blocking. Mature operators hide behind redirectors/CDNs or customise TLS, and benign servers can collide, so confirm with certificate and hosting context and pair external hunts with internal beacon detection.

JARM Fingerprinting and Hunting C2 Server Infrastructure

JARM is an active TLS-server fingerprint: you send a series of crafted ClientHellos and hash how the server responds. Default C2 team servers (Cobalt Strike, Sliver, Metasploit and others) produce recognisable JARM values, which — combined with Shodan/Censys scan data and certificate pivots — let you hunt adversary infrastructure proactively and block it pre-emptively.

Signals at a Glance

Technique	Data source	Outcome
JARM match to known C2 default	Shodan/Censys, active scan	Candidate C2 servers
TLS certificate field / serial pivot	Censys, crt.sh	Linked infrastructure
Default listener ports + banner	Shodan/Censys	Confirmation
Newly-registered domain on candidate IP	Passive DNS	Staging infra

From Fingerprint to Block List

Query scan providers for the JARM of a C2 you care about, then triage the candidates with certificate and hosting context before feeding confirmed infrastructure to egress blocking and proxy reputation:

# Censys / Shodan style hunt (pseudo-query)
services.tls.ja3s: <known_c2_ja3s>
AND services.jarm.fingerprint: "<known_c2_jarm>"
AND services.port: {50050, 443, 8443}
# Then pivot:
#  - certificate.parsed.serial_number (Cobalt Strike default 146473198)
#  - certificate issuer/subject reuse across IPs
#  - passive DNS: domains resolving to the candidate IP
# Output: confirmed IPs/domains -> proxy block + threat-intel platform

Automate the loop: schedule JARM/cert hunts for the C2s most relevant to your threat model and push confirmed indicators into your proxy and firewall as a pre-emptive control.

Caveats

JARM is a default fingerprint — mature operators put C2 behind redirectors, CDNs or custom TLS to change or hide it.
False positives happen: legitimate servers can share a JARM, so confirm with certificate, port and passive-DNS context before blocking.
Treat scan-data hunting as enrichment for your own telemetry, not a replacement — pair external hunts with internal beacon detection.

Vetted sources

Use JARM (SalesForce open-source), Shodan and Censys scan data, crt.sh and passive DNS for pivots. Community lists of C2 JARM values are a starting point; confirm candidates with certificate and hosting context before adding them to block lists.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

From Fingerprint to Block List

Caveats

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

C2 Infrastructure Hunting