Detect Domain Fronting in Splunk
Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation, 'domainless' fronting, utilizes a blank SNI field. Real-world actors including APT29 and tools like Cobalt Strike, Mythic, and SMOKEDHAM have leveraged domain fronting to hide C2 traffic behind legitimate CDN infrastructure.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1090 Proxy
- Sub-technique
- T1090.004 Domain Fronting
- Canonical reference
- https://attack.mitre.org/techniques/T1090/004/
SPL Detection Query
| union
[
search index=proxy OR index=firewall OR index=network sourcetype IN ("bluecoat:proxysg:access:kv", "squid", "pan:traffic", "cisco:asa", "forcepoint:web")
| eval dest_host=lower(coalesce(cs_host, dst_host, desthost, DestinationHostname, x_host_ip))
| eval http_host=lower(coalesce(cs_uri_stem, http_host_header, host_header))
| rex field=_raw "Host:\s*(?P<parsed_host>[^\r\n\s]+)"
| eval http_host=coalesce(http_host, lower(parsed_host))
| eval sni_field=lower(coalesce(tls_sni, ssl_sni, dest_host))
| where isnotnull(sni_field) AND isnotnull(http_host)
| where sni_field != http_host
| eval is_cdn_sni=if(match(sni_field, "(azureedge\.net|cloudfront\.net|akamaiedge\.net|fastly\.net|cloudflare\.com|msecnd\.net|azurefd\.net|amazonaws\.com|googleusercontent\.com|trafficmanager\.net)"), 1, 0)
| eval is_cdn_host=if(match(http_host, "(azureedge\.net|cloudfront\.net|akamaiedge\.net|fastly\.net|cloudflare\.com|msecnd\.net|azurefd\.net|amazonaws\.com|googleusercontent\.com|trafficmanager\.net)"), 1, 0)
| where is_cdn_sni=1 OR is_cdn_host=1
| eval mismatch_type="SNI_Host_Mismatch"
| table _time, src_ip, dest_ip, sni_field, http_host, mismatch_type, url, user, bytes_in, bytes_out, sourcetype
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(DestinationHostname="*.azureedge.net" OR DestinationHostname="*.cloudfront.net" OR DestinationHostname="*.akamaiedge.net" OR DestinationHostname="*.fastly.net" OR DestinationHostname="*.msecnd.net" OR DestinationHostname="*.azurefd.net")
(Image="*\\tor.exe" OR Image="*\\meek.exe" OR Image="*\\obfs4proxy.exe" OR Image="*\\cobalt*" OR Image="*\\beacon*")
| eval mismatch_type="Suspicious_Process_CDN_Connection"
| eval src_ip=SourceIp, dest_ip=DestinationIp, sni_field=DestinationHostname, http_host="unknown"
| table _time, host, User, Image, CommandLine, sni_field, dest_ip, mismatch_type
]
| eval detection_type="Domain_Fronting_T1090.004"
| sort - _timeDetects domain fronting through two complementary search branches. The first branch searches proxy and firewall logs for mismatches between TLS SNI fields and HTTP Host headers when CDN domains are involved — the primary indicator of domain fronting. The second branch searches Sysmon network events for known fronting tools (meek, obfs4proxy, Tor, Cobalt Strike beacons) connecting to CDN infrastructure. Results are unioned and tagged for correlation. Analysts should tune CDN domain lists and add organization-specific known-good exclusions.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate CDN-hosted applications that use different front-end domains for load balancing or A/B testing where SNI and Host headers intentionally differ
- Corporate split-tunneling VPN configurations where internal proxy rewrites Host headers for SSL inspection purposes
- Web application frameworks or reverse proxies that modify Host headers for internal routing
- Security tools (web scanners, penetration testing platforms) that intentionally craft non-standard TLS/HTTP header combinations during authorized testing
Other platforms for T1090.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Domain Fronting HTTP Request with curl
Expected signal: Sysmon Event ID 3 (Network Connection): connection to azureedge.net IP. Network proxy logs (if TLS inspection enabled): SNI=legitimate-front.azureedge.net, Host header=different-domain.azureedge.net — mismatch detected. DNS query for legitimate-front.azureedge.net logged in Sysmon Event ID 22.
- Test 2Install and Run meek-client (Tor Domain Fronting Plugin)
Expected signal: Sysmon Event ID 1: meek-client.exe process creation with -WindowStyle Hidden equivalent arguments including --front=ajax.aspnetcdn.com and --url=https://meek.azureedge.net/. Sysmon Event ID 3: meek-client.exe connecting to azureedge.net on port 443. Sysmon Event ID 22: DNS queries for ajax.aspnetcdn.com and meek.azureedge.net. PowerShell Event ID 4104 from the Invoke-WebRequest download cradle.
- Test 3Cobalt Strike-style Domain Fronting HTTP Request via PowerShell
Expected signal: Sysmon Event ID 3: powershell.exe network connection to ajax.aspnetcdn.com (IP of CDN). Sysmon Event ID 22: DNS query for ajax.aspnetcdn.com. Process Event ID 1 for PowerShell with above CommandLine. Proxy logs (with TLS inspection): Host header value 'c2.attacker-domain.example.com' visible separately from SNI 'ajax.aspnetcdn.com' — mismatch triggers alert.
- Test 4Detect Domainless Fronting via Blank SNI Field
Expected signal: Network logs: TLS ClientHello packet with no SNI extension (empty server_name field in TLS handshake). Proxy logs: destination hostname blank or '-' in the SNI field, while HTTP Host header contains 'target-domain.cloudfront.net'. Sysmon Event ID 3: connection to cloudfront.net IP without associated hostname from DNS.
References (10)
- https://attack.mitre.org/techniques/T1090/004/
- http://www.icir.org/vern/papers/meek-PETS-2015.pdf
- https://www.mandiant.com/resources/blog/no-easy-breach-dhs-and-apt29
- https://www.cobaltstrike.com/blog/cobalt-strike-and-malleaable-c2-profiles/
- https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944
- https://digi.ninja/blog/domain_fronting.php
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://github.com/api0cradle/LOLBAS
- https://unit42.paloaltonetworks.com/domain-fronting/
- https://skylightcyber.com/2019/07/18/cobalt-strike-for-the-win/
Unlock Pro Content
Get the full detection package for T1090.004 including response playbook, investigation guide, and atomic red team tests.