https://live.paloaltonetworks.com/t5/custom-signatures/anyone-know-how-to-compare-two-headers-in-custom-spyware/m-p/469555#M424 <P>Anyone know how to compare two headers in custom spyware signature?</P><P>ie "http-req-host-header" == ssl-req-client-hello&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 01 Mar 2022 18:57:41 GMT LCMember3265 2022-03-01T18:57:41Z https://live.paloaltonetworks.com/t5/custom-signatures/anyone-know-how-to-compare-two-headers-in-custom-spyware/m-p/469555#M424 <P>Anyone know how to compare two headers in custom spyware signature?</P><P>ie "http-req-host-header" == ssl-req-client-hello&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 01 Mar 2022 18:57:41 GMT https://live.paloaltonetworks.com/t5/custom-signatures/anyone-know-how-to-compare-two-headers-in-custom-spyware/m-p/469555#M424 LCMember3265 2022-03-01T18:57:41Z https://live.paloaltonetworks.com/t5/custom-signatures/anyone-know-how-to-compare-two-headers-in-custom-spyware/m-p/469560#M425 <P>More like "http-req-host-header" != "ssl-req-client-hello"</P><P>&nbsp;</P><P>***Domain Fronting Detection&nbsp;</P> Tue, 01 Mar 2022 19:00:13 GMT https://live.paloaltonetworks.com/t5/custom-signatures/anyone-know-how-to-compare-two-headers-in-custom-spyware/m-p/469560#M425 LCMember3265 2022-03-01T19:00:13Z