T1090.004 — Domain Fronting

Tactic: Command and Control · Platforms: Linux, macOS, Windows, ESXi

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting involves using different domain names in the SNI field of…

Sub-technique of Proxy (T1090).

Sigma detection rules (4)

title: "T1090.004 Proxy: Domain Fronting"
id: ba72274f-3129-4527-9942-1216c7f3610d
description: 'Sysmon/Windows Security telemetry (EventID 3 network connections) cannot observe TLS SNI or HTTP Host header values, so true domain fronting (an SNI/Host mismatch) is not detectable from endpoint logs alone; this rule instead flags the closest Windows-observable proxy -- non-browser processes establishing outbound HTTPS connections -- for manual correlation against proxy or TLS-inspection logs that do capture SNI and Host headers. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: SNIHostMismatch, CDNAllowList, ProcessInitiator.'
references:
  - https://attack.mitre.org/techniques/T1090/004
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.004

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
    DestinationPort: 443
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_browsers and not filter_system_account

falsepositives:
  - Non-browser applications (update agents, backup/sync tools, custom software) that legitimately make direct outbound HTTPS connections; a match here is not proof of domain fronting since SNI/Host header data is unavailable in Sysmon -- treat it as a triage lead for correlation with proxy/TLS-inspection logs, not a standalone confirmation. System/service accounts are excluded via filter_system_account.

level: medium

title: "T1090.004 Proxy: Domain Fronting"
id: 79e444d4-800c-4a46-aa43-57c80e0ae536
description: 'Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers. curl has no -servername flag (that option belongs to openssl s_client; curl achieves an SNI/Host mismatch via --resolve/--connect-to combined with a custom Host header), so the prior curl branch of the shared selection could never legitimately fire. Split into an openssl -servername selection and a separate curl selection matching its actual SNI-override mechanism (--resolve/--connect-to plus an explicit Host: header). (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SNIFieldAbsent, AllowedTools, ProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1090/004
author: Shahrukh Khan
date: 2026-03-27
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.004

logsource:
  category: process_creation
  product: linux

detection:
  selection_openssl:
    type: EXECVE
    a0|endswith: '/openssl'
    a1|contains: '-servername'
  selection_curl_tool:
    type: EXECVE
    a0|endswith: '/curl'
  selection_curl_resolve:
    - a1|contains:
        - '--resolve'
        - '--connect-to'
    - a2|contains:
        - '--resolve'
        - '--connect-to'
  selection_curl_host_header:
    - a1|contains: 'Host:'
    - a2|contains: 'Host:'
    - a3|contains: 'Host:'

  condition: selection_openssl or (selection_curl_tool and selection_curl_resolve and selection_curl_host_header)

falsepositives:
  - Domain fronting relies on a TLS SNI/Host header mismatch that raw auditd process-creation records cannot observe at all (no TLS visibility); this rule only flags explicit SNI-override/Host-header usage on the command line and will miss most real domain-fronting traffic (e.g. that implemented inside a compiled binary), so treat as a weak indicator only.

level: low

title: "T1090.004 Proxy: Domain Fronting"
id: 92c6d3ce-f22f-4a46-8d37-f8b7e78d988a
description: 'Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UnsignedBinary, HostHeaderMatch, SOCKSPortAnomaly.'
references:
  - https://attack.mitre.org/techniques/T1090/004
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|contains:
      - '-H "Host:'
      - '--resolve'

  condition: selection

falsepositives:
  - Developers testing CDN configurations legitimately override Host headers with curl; a real Host-header-versus-SNI mismatch is not directly visible without deep packet inspection.

level: medium

title: "T1090.004 Proxy: Domain Fronting"
id: 87a7ffb5-c790-4294-b71b-7f2a59a546e6
description: 'Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminPortAccess, TLSHandshakeOutliers, DomainMismatchThreshold.'
references:
  - https://attack.mitre.org/techniques/T1090/004
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1090.004

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Firewall'
  selection_admin:
    Message|contains|all:
      - 'ruleset'
      - '443'

  condition: selection and selection_admin

falsepositives:
  - ESXi host logs cannot inspect the TLS SNI or Host header mismatch that defines domain fronting, so this is only a coarse proxy on firewall rule changes permitting outbound 443 traffic, which normal update and patch operations also require.

level: low

Related sub-techniques

• T1090.003 Multi-hop Proxy
• T1090.002 External Proxy
• T1090.001 Internal Proxy

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1090.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan