TLS Spoofing
| ID: | TEQ-098 |
| Phase(s): | Defence Bypass |
| Tactic(s): | Device Emulation |
The adversary modifies TLS (Transport Layer Security) handshake attributes to evade detection or mimic legitimate traffic. For example, attackers can spoof JA3 or JA4 fingerprints to make automated traffic appear as if it originates from a real browser.