Techniques › T1090 › T1090.004
T1090.004 Domain Fronting
command and control — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
1
Sigma rules tagged attack.t1090.004
0
KEV CVEs mapped here
<p>Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).</p><p>For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0196 Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers v1.0
AN0564 WindowsSuspicious outbound HTTPS connections where the TLS Server Name Indication (SNI) does not match the HTTP Host header, indicating potential use of domain fronting to mask C2 traffic via CDNs.Tunable:
SNIHostMismatchCDNAllowListProcessInitiatorAN0565 LinuxApplications such ascurl,wget, or custom binaries initiate HTTPS connections where the TLS SNI is mismatched or absent while HTTP Host targets CDN-available C2 endpoints.Tunable:SNIFieldAbsentAllowedToolsProcessContextAN0566 macOSUnsigned or user-space apps initiate TLS connections with one hostname and HTTP headers requesting a different domain, commonly abused in CDN-resident domain fronting techniques.Tunable:UnsignedBinaryHostHeaderMatchSOCKSPortAnomalyAN0567 ESXiTraffic originating from ESXi hosts or management interfaces displays SNI-to-Host mismatch behavior, particularly anomalous given typical infrastructure communication patterns.Tunable:AdminPortAccessTLSHandshakeOutliersDomainMismatchThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1090.004
Author: Isaac Dunham
· 2024-11-07 · logsource: product=windows category=network_connection · 8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
Rules tagged at the parent level (attack.t1090) 22
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2022-11-03 · logsource: product=linux category=network_connection · 19bf6fdb-7721-4f3d-867f-53467f6a5db6
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2022-11-03 (modified 2024-02-02) · logsource: product=windows category=network_connection · 1d08ac94-400d-4469-a82f-daee9a908849
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel
· 2019-01-29 (modified 2023-09-01) · logsource: product=windows category=process_creation · 322ed9ec-fcab-4f67-9a34-e7c6aef43614
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
Author: frack113, Florian Roth
· 2022-09-02 (modified 2024-11-23) · logsource: product=windows category=process_creation · 32410e29-5f94-4568-b6a3-d91a8adad863
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · 36440e1c-5c22-467a-889b-593e66498472
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=windows category=network_connection · 3ab65069-d82a-4d44-a759-466661a082d1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 5498fc09-adc6-4804-b9d9-5cca1f0b8760
Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
Author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)
· 2024-06-03 · logsource: product=windows category=process_creation · 5fc297ae-25b6-488a-8f25-cc12ac29b744
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Author: Florian Roth (Nextron Systems)
· 2022-04-29 · logsource: product=windows service=terminalservices-localsessionmanager · 64d51a51-32a6-49f0-9f3d-17e34d640272
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Author: Florian Roth (Nextron Systems)
· 2022-10-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 68d37776-61db-42f5-bf54-27e87072d17e
Detects the use of NPS, a port forwarding and intranet penetration proxy server
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-21) · logsource: product=windows category=process_creation · 7050bba1-1aed-454e-8f73-3f46f09ce56a
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Author: Ömer Günal
· 2020-06-17 (modified 2022-10-05) · logsource: product=linux category=process_creation · 72f4ab3f-787d-495d-a55d-68c2ff46cf4c
Detects setting proxy configuration
Author: Florian Roth (Nextron Systems), oscd.community
· 2019-01-29 (modified 2023-02-13) · logsource: product=windows category=process_creation · 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 821b4dc3-1295-41e7-b157-39ab212dd6bd
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
· 2023-05-17 (modified 2023-12-20) · logsource: product=windows category=process_creation · 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-07 · logsource: product=azure service=riskdetection · a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd
Indicates sign-in from a malicious IP address based on high failure rates.
Author: Andreas Hunkeler (@Karneades)
· 2021-06-22 (modified 2024-03-25) · logsource: product=windows category=registry_event · a54f842a-3713-4b45-8c84-5f136fdebd3c
Detects the modification of the PortProxy registry key which is used for port forwarding.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-08 · logsource: product=windows category=ps_script · bd33d2aa-497e-4651-9893-5c5364646595
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Author: Andreas Braathen (mnemonic.io)
· 2024-06-17 · logsource: product=linux category=network_connection · c4568f5d-131f-4e78-83d4-45b2da0ec4f1
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Author: Florian Roth (Nextron Systems)
· 2022-10-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · d7654f02-e04b-4934-9838-65c46f187ebc
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.
Author: Florian Roth (Nextron Systems)
· 2022-12-27 (modified 2023-02-04) · logsource: product=windows category=process_creation · f5e3b62f-e577-4e59-931e-0a15b2b94e1e
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)