topic Re: How to detect domain fronting in Advanced Threat Prevention Discussions

How to detect domain fronting

AndreasB — Fri, 15 Mar 2019 10:31:19 GMT

Hi,

did anyone manage to write a custom signature to detect domain fronting?

PA extracts the Host header, so in theory it should be possible to detect if the Host header is different from the URL?

Alternatively, if one could log the Host header one could develop external detection logic in a SIEM.

Regards,

Andreas

mivaldi — Wed, 03 Apr 2019 17:53:58 GMT

Check Anti-spyware signature 14984.

Documentation is available at:

bgriffin — Wed, 11 May 2022 08:50:34 GMT

My customer had a query how PA detects Domain Fronting in PanOS, how it is logged and how it can be mitigated. This document helped: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/content-inspection-features/domain-fronting-detection