SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-domain-fronting-and-cdn-abuse
0
Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. Activates for requests to hunt domain fronting, detect SNI/Host mismatch, or find CDN abuse used to mask C2.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Domain Fronting and CDN Abuse ## When to Use - You have TLS/HTTP telemetry (Zeek ssl.log + http.log, proxy logs) and want to detect domain fronting, where the TLS SNI shows a benign CDN domain but the inner HTTP Host differs. - You are hunting C2 hidden behind high-reputation CDNs. **Do not use** SNI/Host mismatch as definitive — some legitimate setups differ. Corroborate with destination behavior and reputation. ## Prerequisites - Telemetry pairing TLS SNI with the inner HTTP Host (or proxy logs exposing both). ## Workflow ### Step 1: Detect SNI/Host mismatch ```bash python scripts/analyst.py hunt flows.csv ``` Flags connections where the TLS SNI and HTTP Host headers resolve to different registered domains, especially when the SNI is a known CDN/fronting-capable domain. ### Step 2: Surface CDN-hosted anomalies Highlight high-reputation CDN SNIs carrying long-lived or beaconing flows. ### Step 3: Confirm Corroborate with beacon periodicity, JA3, and destination reputation; many CDN mismatches are benign. ### Step 4: Operationalize Write a detection for SNI/Host registered-domain mismatch on fronting-capable CDNs. ## Validation - Mismatch is computed on the registered domain, not the full hostname. - Known CDN SNIs are recognized to prioritize fronting-capable cases. - Findings are presented with corroboration needs, not as proof. ## Pitfalls - Legitimate multi-tenant CDN/edge configs producing benign mismatches. - Encrypted SNI (ECH) hiding the SNI entirely — different hunt required. - Treating any CDN traffic as suspicious (high false-positive rate). ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK T1090.004 and the TLS SNI RFC (linked in frontmatter).