tfMITRE ATT&CK sub-technique

Domain Fronting T1090.004

sub-technique of T1090 Proxy

Tactic: Command and Control
Platforms: Linux, macOS, Windows, ESXi
Version: 1.2
Created: 14 March 2020
Last modified: 24 October 2025
Contributor: Matt Kelly, @breakersall

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. [1] Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Domain Fronting MITRE reference T1090.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT29G0016 ↗

Has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.1

created 2017-05-311 referenceaka IRON RITUAL

All 1 groups for this technique

Offense vs defense T1090.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2024 Q4

Domain Fronting detection strategy DET0196

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers

Enterprise

4 platforms

AN0564 · Windows

Suspicious outbound HTTPS connections where the TLS Server Name Indication (SNI) does not match the HTTP Host header, indicating potential use of domain fronting to mask C2 traffic via CDNs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Connections	TLS handshake + HTTP headers

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SNIHostMismatch	Define acceptable mismatch ratio between SNI and HTTP Host fields based on legitimate domain usage patterns.
CDNAllowList	Whitelist of known safe CDN front-end domains (e.g., `cdn.company.com`).
ProcessInitiator	Filter for suspicious initiators of domain fronting, e.g., scripting engines, lolbins, unknown binaries.

AN0565 · Linux

Applications such as curl, wget, or custom binaries initiate HTTPS connections where the TLS SNI is mismatched or absent while HTTP Host targets CDN-available C2 endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic ContentDC0085	NSM:Flow	ssl.log + http.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SNIFieldAbsent	Detect TLS sessions where SNI is empty—'domainless' fronting.
AllowedTools	Environmental tuning for known binaries using alternate SNI for testing (e.g., API tests).
ProcessContext	Enrich command-line arguments or parent-child lineage to detect abuse.

AN0566 · macOS

Unsigned or user-space apps initiate TLS connections with one hostname and HTTP headers requesting a different domain, commonly abused in CDN-resident domain fronting techniques.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Network Traffic ContentDC0085	macos:unifiedlog	network, socket, and http logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UnsignedBinary	Helps tune detection when unsigned apps initiate fronted sessions.
HostHeaderMatch	Threshold to flag inconsistent domain targeting in encrypted sessions.
SOCKSPortAnomaly	Alert on unusual ports used in HTTPS+SOCKS activity patterns.

AN0567 · ESXi

Traffic originating from ESXi hosts or management interfaces displays SNI-to-Host mismatch behavior, particularly anomalous given typical infrastructure communication patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:shell	/var/log/vmkernel.log, /var/log/vmkwarning.log
Network Traffic ContentDC0085	NSM:Firewall	TLS/HTTP inspection

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AdminPortAccess	ESXi hosts should rarely initiate external HTTPS—threshold to alert.
TLSHandshakeOutliers	Define entropy or timing anomalies for TLS handshake.
DomainMismatchThreshold	SNI/Host mismatch occurrence tolerance.

Domain Fronting detections T1090.004

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs