Which SIEM platforms have a T1090.004 detection rule?

df00tech provides T1090.004 (Domain Fronting) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Domain Fronting (T1090.004)?

Detecting Domain Fronting requires the following data sources: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Application Log: Application Log Content.

What severity and confidence is the T1090.004 detection?

The T1090.004 detection is rated high severity with medium confidence.

What are common false positives for T1090.004?

Common false positives for T1090.004 include: Legitimate CDN-hosted applications that use different front-end domains for load balancing or A/B testing where SNI and Host headers intentionally differ; Corporate split-tunneling VPN configurations where internal proxy rewrites Host headers for SSL inspection purposes; Web application frameworks or reverse proxies (nginx, HAProxy) that modify Host headers for internal routing, appearing as mismatches in proxy logs.

T1090.004 Elastic Security · Elastic

Detect Domain Fronting in Elastic Security

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation, 'domainless' fronting, utilizes a blank SNI field. Real-world actors including APT29 and tools like Cobalt Strike, Mythic, and SMOKEDHAM have leveraged domain fronting to hide C2 traffic behind legitimate CDN infrastructure.

MITRE ATT&CK

Tactic: Command and Control
Technique: T1090 Proxy
Sub-technique: T1090.004 Domain Fronting
Canonical reference: https://attack.mitre.org/techniques/T1090/004/

Elastic Detection Query

Elastic Security (Elastic)

eql

/* Domain Fronting Detection — T1090.004
   Requires proxy/network logs with TLS inspection forwarded to Elastic
   tls.client.server_name = TLS SNI extension value
   http.request.headers.host = HTTP Host header (requires proxy or packet inspection)
   Packetbeat, Zeek HTTP+SSL logs, or Elastic Agent network integration satisfy both fields
*/
network where event.category == "network"
  and event.type == "connection"
  and network.transport == "tcp"
  and destination.port == 443
  and tls.client.server_name != null
  and tls.client.server_name != ""
  and http.request.headers.host != null
  and http.request.headers.host != ""
  and tls.client.server_name != http.request.headers.host
  and (
    tls.client.server_name like~ "*.azureedge.net"
    or tls.client.server_name like~ "*.cloudfront.net"
    or tls.client.server_name like~ "*.akamaiedge.net"
    or tls.client.server_name like~ "*.fastly.net"
    or tls.client.server_name like~ "*.cloudflare.com"
    or tls.client.server_name like~ "*.msecnd.net"
    or tls.client.server_name like~ "*.azurefd.net"
    or tls.client.server_name like~ "*.amazonaws.com"
    or tls.client.server_name like~ "*.googleusercontent.com"
    or http.request.headers.host like~ "*.azureedge.net"
    or http.request.headers.host like~ "*.cloudfront.net"
    or http.request.headers.host like~ "*.akamaiedge.net"
    or http.request.headers.host like~ "*.fastly.net"
    or http.request.headers.host like~ "*.cloudflare.com"
    or http.request.headers.host like~ "*.msecnd.net"
    or http.request.headers.host like~ "*.azurefd.net"
    or http.request.headers.host like~ "*.amazonaws.com"
    or http.request.headers.host like~ "*.googleusercontent.com"
  )

high severity medium confidence

Detects domain fronting (T1090.004) by identifying mismatches between the TLS SNI extension value and the HTTP Host header in HTTPS connections routed through known CDN providers. Domain fronting abuses CDN routing — the CDN terminates TLS using the SNI certificate, then forwards the request to the host specified in the HTTP layer, allowing C2 traffic to hide behind legitimate CDN infrastructure. APT29, Cobalt Strike, Mythic, and SMOKEDHAM all leverage this technique. Detection requires data sources that capture both TLS metadata and decrypted HTTP headers, such as Packetbeat, Zeek, or a proxy forwarding both fields to Elastic.

Data Sources

Packetbeat network flow data with TLS and HTTP dissection enabledZeek network sensor logs (conn.log, ssl.log, http.log) ingested via Elastic Agent or FilebeatWeb proxy logs (Squid, Bluecoat, Zscaler) forwarded to Elastic with both TLS SNI and HTTP Host fields parsedElastic Agent network events with packet capture integration on sensor hosts

Required Tables

packetbeat-*logs-zeek.network_traffic-*logs-network_traffic.tls-*.ds-logs-endpoint.events.network-*

False Positives & Tuning

Multi-tenant CDN configurations legitimately use different SNI and Host values for internal routing between edge PoPs — Azure Front Door and AWS CloudFront both employ this architecture for some enterprise customer deployments, generating high-volume benign matches
Corporate SSL inspection proxies (Zscaler, Netskope, Symantec Blue Coat) re-encrypt traffic and may rewrite or split TLS SNI and HTTP Host fields as a side-effect of their inspection pipeline, creating apparent mismatches that do not represent domain fronting
Mobile application SDKs and embedded frameworks (React Native, Flutter, Xamarin) frequently establish TLS sessions using a CDN apex domain in the SNI while sending per-service subdomains in the Host header for API routing — common in apps using Cloudflare or AWS infrastructure

Download portable Sigma rule (.yml)

Other platforms for T1090.004

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate Domain Fronting HTTP Request with curl
Expected signal: Sysmon Event ID 3 (Network Connection): connection to azureedge.net IP. Network proxy logs (if TLS inspection enabled): SNI=legitimate-front.azureedge.net, Host header=different-domain.azureedge.net — mismatch detected. DNS query for legitimate-front.azureedge.net logged in Sysmon Event ID 22.
Test 2Install and Run meek-client (Tor Domain Fronting Plugin)
Expected signal: Sysmon Event ID 1: meek-client.exe process creation with -WindowStyle Hidden equivalent arguments including --front=ajax.aspnetcdn.com and --url=https://meek.azureedge.net/. Sysmon Event ID 3: meek-client.exe connecting to azureedge.net on port 443. Sysmon Event ID 22: DNS queries for ajax.aspnetcdn.com and meek.azureedge.net. PowerShell Event ID 4104 from the Invoke-WebRequest download cradle.
Test 3Cobalt Strike-style Domain Fronting HTTP Request via PowerShell
Expected signal: Sysmon Event ID 3: powershell.exe network connection to ajax.aspnetcdn.com (IP of CDN). Sysmon Event ID 22: DNS query for ajax.aspnetcdn.com. Process Event ID 1 for PowerShell with above CommandLine. Proxy logs (with TLS inspection): Host header value 'c2.attacker-domain.example.com' visible separately from SNI 'ajax.aspnetcdn.com' — mismatch triggers alert.
Test 4Detect Domainless Fronting via Blank SNI Field
Expected signal: Network logs: TLS ClientHello packet with no SNI extension (empty server_name field in TLS handshake). Proxy logs: destination hostname blank or '-' in the SNI field, while HTTP Host header contains 'target-domain.cloudfront.net'. Sysmon Event ID 3: connection to cloudfront.net IP without associated hostname from DNS.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1090.004 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Domain Fronting in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1090.004

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1090.004

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

Get new detections in your inbox