tool

meek S0175

Type: tool
Platforms: Linux, Windows, macOS
Created: 16 January 2018
Last modified: 25 April 2025

meek is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.

TechniqueBottom 5%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

meek MITRE reference S0175

Domain Fronting T1090.004 ↗

meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.

Command and Control1 detection rules

Standing S0175

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique1medBottom 1%

1st percentile · 99% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique0med

meek detections S0175

1 distinct rule cover the 1 technique recorded for this tool. 1 Sigma.

1 covered by at least one rule1 distinct rules in total

Showing 1-1 of 1 rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2) th (...)	Hunting	test	network_connection	windows	Sysmon	Command and Control Proxy Domain Fronting Command and Control Web Service Bidirectional Communication	-	medium	Isaac Dunham	2024-11-07	—	8cb4d14e-776e-43c2-8fb9-91e7fcea32b4

Standing S0175

Title

Description