AN0564
Analytic 0564
Windows
Suspicious outbound HTTPS connections where the TLS Server Name Indication (SNI) does not match the HTTP Host header, indicating potential use of domain fronting to mask C2 traffic via CDNs.
NSM:Connections
TLS handshake + HTTP headers
WinEventLog:Sysmon
EventCode=3, 22
[SNIHostMismatch]
Define acceptable mismatch ratio between SNI and HTTP Host fields based on legitimate domain usage patterns.
[CDNAllowList]
Whitelist of known safe CDN front-end domains (e.g., `cdn.company.com`).
[ProcessInitiator]
Filter for suspicious initiators of domain fronting, e.g., scripting engines, lolbins, unknown binaries.
AN0565
Analytic 0565
Linux
Applications such as `curl`, `wget`, or custom binaries initiate HTTPS connections where the TLS SNI is mismatched or absent while HTTP Host targets CDN-available C2 endpoints.
NSM:Flow
ssl.log + http.log
auditd:SYSCALL
execve
[SNIFieldAbsent]
Detect TLS sessions where SNI is empty—'domainless' fronting.
[AllowedTools]
Environmental tuning for known binaries using alternate SNI for testing (e.g., API tests).
[ProcessContext]
Enrich command-line arguments or parent-child lineage to detect abuse.
AN0566
Analytic 0566
macOS
Unsigned or user-space apps initiate TLS connections with one hostname and HTTP headers requesting a different domain, commonly abused in CDN-resident domain fronting techniques.
macos:unifiedlog
network, socket, and http logs
macos:osquery
process_events
[UnsignedBinary]
Helps tune detection when unsigned apps initiate fronted sessions.
[HostHeaderMatch]
Threshold to flag inconsistent domain targeting in encrypted sessions.
[SOCKSPortAnomaly]
Alert on unusual ports used in HTTPS+SOCKS activity patterns.
AN0567
Analytic 0567
ESXi
Traffic originating from ESXi hosts or management interfaces displays SNI-to-Host mismatch behavior, particularly anomalous given typical infrastructure communication patterns.
NSM:Firewall
TLS/HTTP inspection
esxi:shell
/var/log/vmkernel.log, /var/log/vmkwarning.log
[AdminPortAccess]
ESXi hosts should rarely initiate external HTTPS—threshold to alert.
[TLSHandshakeOutliers]
Define entropy or timing anomalies for TLS handshake.
[DomainMismatchThreshold]
SNI/Host mismatch occurrence tolerance.