The Hunting for Domain Fronting C2 Traffic skill is designed for cybersecurity professionals who need to identify and analyze command-and-control (C2) traffic that utilizes domain fronting techniques. This method allows attackers to disguise their malicious activities by using different domain names in the TLS Server Name Indication (SNI) field and the HTTP Host header. By leveraging this skill, users can effectively parse proxy logs to detect mismatches between these fields, which is a key indicator of potential domain fronting.

The skill operates by parsing web proxy or secure web gateway logs that contain SNI and Host header fields. It compares the SNI domain against the HTTP Host header to identify discrepancies. Additionally, it utilizes the pyOpenSSL library to extract TLS certificate information, enabling the identification of connections that are hosted on Content Delivery Network (CDN) services. By correlating this data with known CDN provider IP ranges, the skill flags high-confidence domain fronting instances where the SNI points to a reputable domain while the Host header targets a potentially malicious domain.

This skill is particularly useful for Security Operations Center (SOC) analysts and threat hunters who are investigating security incidents or building detection rules related to domain fronting. It provides structured procedures for analyzing proxy logs and validates the effectiveness of existing security monitoring coverage. The output is a comprehensive JSON report that includes detected domain fronting indicators, SNI-Host pairs, certificate details, and confidence scores, all mapped to the relevant MITRE ATT&CK technique.

By integrating this skill into their security toolkit, analysts can enhance their threat detection capabilities and respond more effectively to sophisticated evasion tactics employed by attackers.