agentsclimarketplace

Hunting domain fronting and cdn abuse

Skill meltedinhex/analyst-ai-pack/skills/hunting-domain-fronting-and-cdn-abuse

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-domain-fronting-and-cdn-abuse

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. Activates for requests to hunt domain fronting, detect SNI/Host mismatch, or find CDN abuse used to mask C2.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.5 KB, as published. Nobody here has run it

Hunting Domain Fronting and CDN Abuse

When to Use

  • You have TLS/HTTP telemetry (Zeek ssl.log + http.log, proxy logs) and want to detect domain fronting, where the TLS SNI shows a benign CDN domain but the inner HTTP Host differs.
  • You are hunting C2 hidden behind high-reputation CDNs.

Do not use SNI/Host mismatch as definitive — some legitimate setups differ. Corroborate with destination behavior and reputation.

Prerequisites

  • Telemetry pairing TLS SNI with the inner HTTP Host (or proxy logs exposing both).

Workflow

Step 1: Detect SNI/Host mismatch

python scripts/analyst.py hunt flows.csv

Flags connections where the TLS SNI and HTTP Host headers resolve to different registered domains, especially when the SNI is a known CDN/fronting-capable domain.

Step 2: Surface CDN-hosted anomalies

Highlight high-reputation CDN SNIs carrying long-lived or beaconing flows.

Step 3: Confirm

Corroborate with beacon periodicity, JA3, and destination reputation; many CDN mismatches are benign.

Step 4: Operationalize

Write a detection for SNI/Host registered-domain mismatch on fronting-capable CDNs.

Validation

  • Mismatch is computed on the registered domain, not the full hostname.
  • Known CDN SNIs are recognized to prioritize fronting-capable cases.
  • Findings are presented with corroboration needs, not as proof.

Pitfalls

  • Legitimate multi-tenant CDN/edge configs producing benign mismatches.
  • Encrypted SNI (ECH) hiding the SNI entirely — different hunt required.
  • Treating any CDN traffic as suspicious (high false-positive rate).

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.