T1090.004sub-technique of T1090 Proxy
Domain Fronting
Linux · macOS · Windows · ESXinothing on this site yetT1090.004 on attack.mitre.org
Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header.
how MITRE says to see it
Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers
- Suspicious outbound HTTPS connections where the TLS Server Name Indication (SNI) does not match the HTTP Host header, indicating potential use of domain fronting to mask C2 traffic via CDNs.
- Applications such as `curl`, `wget`, or custom binaries initiate HTTPS connections where the TLS SNI is mismatched or absent while HTTP Host targets CDN-available C2 endpoints.
- Unsigned or user-space apps initiate TLS connections with one hostname and HTTP headers requesting a different domain, commonly abused in CDN-resident domain fronting techniques.
- Traffic originating from ESXi hosts or management interfaces displays SNI-to-Host mismatch behavior, particularly anomalous given typical infrastructure communication patterns.
what reduces it
- M1020 SSL/TLS Inspection. If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.